FreeRDP versions prior to 3.31.0 contain a heap out‑of‑bounds read in the general_ChromaV1ToYUV444 function when processing AVC444 chroma plane reconstruction. A malicious remote desktop protocol server can craft an RFX_AVC444_BITMAP_STREAM with special frame geometry that forces the client to read past the end of the allocated luma plane. The out‑of‑bounds read could expose arbitrary memory contents on the client, potentially leading to information disclosure or a crash. The weakness is classified as CWE‑125.

Products affected are the FreeRDP client, specifically any release before 3.31.0. The vulnerability is present in the libfreerdp implementation of the YUV conversion routines, as detailed in the change committed on 2026 and fixed with the release of version 3.31.0. Users running older versions of the client are at risk if they connect to a host capable of sending crafted AVC444 bitmaps.

With a CVSS score of 5.3, the vulnerability is considered moderate. Its EPSS score is not available, and there is no CISA KEV listing, indicating that it is not currently known to be exploited in the wild, but no data rules out future exploitation. The likely attack vector is a remote attacker acting as an RDP server, requiring the client to connect to the malicious host. The attacker needs no additional privileges on the client; simply sending the crafted bitmap during the connection can trigger the out‑of‑bounds read.