A heap‑buffer‑overflow occurs in the FreeRDP client’s gdi_CacheToSurface function when handling RDPGFX packets. The function clamps a destination rectangle to a 16‑bit maximum but copies data using the original, potentially oversized, width and height values. This flaw can cause a large out‑of‑bounds write, leading to client crashes or execution of arbitrary code on the client machine. The weakness is a classic buffer overflow (CWE‑122).

The vulnerability affects the FreeRDP client prior to version 3.26.0. Clients that have RDPGFX enabled are susceptible; any deployment of FreeRDP 3.25.x or earlier running RDPGFX is at risk.

The CVSS score of 8.8 reflects a high severity impact. The EPSS score is currently not available, and the issue is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. A malicious RDP server can trigger the flaw remotely; the attacker only needs to send crafted RDPGFX PDUs to an affected client with RDPGFX enabled. The attack vector is server‑initiated remote exploitation and requires no special client privileges beyond normal usage. Given the high severity and potential for code execution, the risk to exposed or internal networks remains significant.