The vulnerability arises in FreeRDP versions prior to 3.29.0, where the glyph cache update functions read a size value supplied by the remote server without checking that it fits into the remaining received data. This out-of-bounds read can expose arbitrary client memory contents and causes a crash, resulting in a denial of service. The flaw is a classic heap read out of bounds (CWE-125).

FreeRDP deployments using any release version 3.28.0 or older are affected. The issue is present in the core glyph handling module of the client library. Systems running these versions should consider an upgrade to 3.29.0 or later, which removes the unvalidated copy operation.

With a CVSS score of 8.7 the vulnerability is rated high. The EPSS score is not available, so the current probability of exploitation is unclear, but the flaw is listed in no KEV catalog. A malicious RDP server can send a crafted GLYPH_FRAGMENT_ADD update that declares a fragment size longer than the transmitted data, allowing an attacker to trigger the out-of-bounds read from any remote host that accepts their connection. This attack requires network access to the vulnerable client and does not depend on local privileges; the impact is deterministic crash, not a remote code execution.