FreeRDP clients use the Remote Desktop Protocol. In versions prior to 3.28.0 on 32‑bit builds, the update_read_delta_points function multiplies an attacker‑controlled count by sizeof(DELTA_POINT). Because the calculation uses an unsigned 32‑bit integer, an overflow occurs, causing the allocator to request fewer bytes than required. The subsequent write of delta point data overruns the heap buffer, giving the attacker arbitrary code execution or the ability to crash the client. The vulnerability is a classic heap buffer overflow (CWE‑122, CWE‑787) triggered by integer overflow (CWE‑190).

All FreeRDP clients compiled for 32‑bit architectures with a version earlier than 3.28.0 are vulnerable. The issue does not affect 64‑bit builds. Updating to 3.28.0 or later removes the flawed code path.

The CVSS score of 8.6 classifies this as high severity, however the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not recorded in CISA KEV, suggesting limited exploitation. An attacker would need to act as a malicious RDP peer, sending a specially crafted packet during the handshake or connection initialization to trigger the overflow. Fixing the code in 3.28.0 eliminates the attack surface.