FreeRDP clients that negotiate the RDPGFX AVC444 format with an H.264 backend compute an intermediate YUV444 buffer size using 32‑bit multiplication in avc444_ensure_buffer. If an attacker‑controlled RDP server supplies surface dimensions that cause the stride multiplied by the height to wrap to a small nonzero value, the calculated buffer size becomes undersized. The subsequent YUV420CombineToYUV444 write then overflows the heap, which can crash the client and potentially corrupt heap memory to enable arbitrary code execution.

All FreeRDP clients before version 3.27.0 that support RDPGFX AVC444 with an H.264 decoder are affected. The vulnerability is mitigated in the 3.27.0 release, which adjusts the buffer size calculations to use safe arithmetic.

The flaw carries a CVSS score of 8.7 and is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low exploitation probability, but exploitation requires only the ability to act as an RDP server and to send crafted surface dimensions, making it a remotely exploitable issue that could lead to code execution if heap corruption is achieved.