The vulnerability exists when a FreeRDP client processes responses from a TS Gateway. The rpc_client_recv_fragment function calculates the buffer capacity for reassembly using only the server‑declared alloc_hint instead of the actual StubLength. A malicious gateway can send a PTYPE_RESPONSE with a small alloc_hint and a larger frag_length, causing the Stream_Write operation to copy attacker‑controlled stub data past the 4096‑byte pdu->s buffer, corrupting heap memory. This overflow can crash the client or even enable remote code execution. The flaw is identified as a heap‑buffer overflow (CWE‑122) and a buffer copy without length or boundary check (CWE‑120).

All FreeRDP releases prior to version 3.27.0 are affected. The patch is included in release 3.27.0, so any builds at or above that version are not affected.

The CVSS score of 8.7 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation but still present. The vulnerability is globally relevant because RDP is widely deployed. The issue is not listed in CISA’s KEV catalog, implying no identified active exploitation yet. The likely attack vector is a remote attacker using a malicious TS Gateway to send crafted PTYPE_RESPONSE packets to a FreeRDP client, which, if exploited, can result in a client crash or arbitrary code execution.