This vulnerability exists in the planar bitmap decoder of FreeRDP, where the function freerdp_bitmap_decompress_planar() fails to enforce bounds validation for the temporary buffer pTempData. An attacker who supplies a specially crafted Remote Desktop Protocol packet containing large X destination coordinates and a large destination stride can cause the decoder to write beyond the end of the heap buffer. The resulting memory corruption is an out‑of‑bounds heap write (CWE‑787).

All released FreeRDP binaries earlier than version 3.26.0 are affected. Clients and remote‑desktop servers that use these older FreeRDP versions are vulnerable when they process RLE planar bitmap data from a remote session.

The CVSS score of 7.7 indicates high severity. The EPSS score of 4% suggests a moderate likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw is remotely exploitable over an RDP session; the CVE description does not explicitly state whether local privileges are required, so the privilege level remains uncertain.