FreeRDP clients that enable RemoteFX decoding via the /cache:codec:rfx option allocate a bitmap data buffer based on the target destination width and height. A malicious Remote Desktop Protocol server can supply an RDP stream containing bitmap streams whose stride and height exceed the allocated destination size, causing a heap out‑of‑bounds write when the RemoteFX Cache Bitmap V3 decoder processes the data. This memory corruption can lead to overwrite of control data on the heap, potentially compromising data integrity and causing a denial of service by crashing the client application.

The vulnerability affects FreeRDP clients distributed as FreeRDP prior to version 3.27.1. Users running any FreeRDP build older than 3.27.1 and employing RemoteFX decoding are at risk. No specific subsystem versions beyond the main client releases are listed.

The CVSS score of 7.5 indicates a medium‑to‑high severity. The EPSS score is less than 1% indicating a very low exploitation probability, and the absence of a KEV listing suggests that widespread exploitation has not yet been observed. An attacker would need to act as an RDP server to transmit a crafted RFX bitmap stream to the vulnerable client. The failure occurs on the client side, making the attack remote and likely to be triggered by any remote desktop connection that is not trusted.