Based on the description, it is inferred that an integer overflow in FreeRDP’s freerdp_image_copy_from_icon_data function allows a malicious Remote Desktop Protocol server to send an oversized icon update that bypasses bounds checks. The overflow wraps the size calculation, letting the client read attacker‑controlled icon data during a RemoteApp session. This may corrupt memory within the client’s process and potentially enable arbitrary code execution, but the exact outcome is not directly confirmed in the advisories.

The issue affects all installations of FreeRDP using the vulnerable library path prior to version 3.27.0, including RemoteApp clients that rely on that code. The xfreerdp client incorporates a caller-side mitigation that protects against this overflow, so clients using xfreerdp are not impacted by the flaw.

The CVSS score of 6.1 denotes a moderate severity. Based on the description, it is inferred that the potential impact could lead to arbitrary code execution. The attack vector is inferred to be remote server‑initiated, as it requires a malicious RDP server to send specially crafted RAIL TS_ICON_INFO updates. Exploitation probability is low, with an EPSS score of < 1%, and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability exploits a trusted client session, making it a high‑impact concern for environments accepting connections from untrusted servers.