FreeRDP prior to 3.29.0 contains a heap out‑of‑bounds read in the TSMF FFmpeg decoder. When parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData the decoder reads at fixed offsets without validating the source buffer length, causing a crash. This results in a loss of service for the affected client and may expose sensitive memory contents if the crash occurs during privileged execution.

The vulnerable components are part of the FreeRDP project, version 3.29.0 and earlier. The issue affects users running any FreeRDP client that processes TSMF media streams, particularly those that accept AVC1 MPEG2VIDEOINFO formats, on any operating system supported by FreeRDP.

The CVSS score of 8.7 indicates a high severity vulnerability. An attacker can trigger the crash by sending a carefully crafted media format from a server to a FreeRDP client over the network; no elevated privileges are required on the client. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of a public exploit does not mitigate the impact of the denial of service. Because the flaw is triggered by an external server, the risk remains high for clients that accept arbitrary media streams.