A heap buffer overflow vulnerability in FreeRDP clients allows a malicious server to gain control of the instruction pointer and execute arbitrary code on the client machine.

This vulnerability is a heap buffer overflow (CWE-787) occurring within the gdi_SurfaceCommand_ClearCodec() function. A malicious RDP server can send a specially crafted ClearCodec surface command that lacks proper bounds validation for the destination rectangle, leading to an out-of-bounds write that corrupts memory and facilitates control over indirect function pointers.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the client system, which could lead to full system compromise, data theft, and unauthorized access to internal networks. With a CVSS score of 8.8, this vulnerability is classified as High severity because it poses a significant risk to the integrity and security of any environment where FreeRDP clients connect to potentially untrusted RDP servers.

Immediate Action: Update all FreeRDP client installations to version 3.23.0 or later to apply the necessary bounds checking patches.

Proactive Monitoring: Monitor client-side endpoint logs for unexpected crashes of the xfreerdp process or unusual binary execution patterns that may indicate memory corruption attempts.

Compensating Controls: Ensure that RDP clients only connect to trusted and authenticated RDP servers, and implement network-level controls to restrict outbound RDP traffic to known, authorized endpoints.

Public Exploit Available: Unknown

Given the potential for remote code execution and the confirmed existence of proof-of-concept material, this vulnerability represents a significant risk to organizational endpoints. Administrators must prioritize the deployment of the 3.23.0 update across all affected systems immediately. Failure to patch leaves client machines vulnerable to compromise when connecting to malicious or compromised RDP servers.