A critical out-of-bounds write vulnerability in FreeRDP allows a malicious server to execute arbitrary code on client systems, necessitating an immediate update to version 3.23.0.

This vulnerability is an out-of-bounds write (CWE-787) located in the planar decompression function. An unauthenticated attacker operating a malicious RDP server can trigger memory corruption on a connecting client, leading to the overwriting of critical function pointers and potential remote code execution.

The vulnerability presents a high risk to organizations that utilize FreeRDP for remote connectivity. Successful exploitation grants an attacker the ability to execute arbitrary code on client machines, which could lead to full system compromise, data exfiltration, or the deployment of ransomware. Given the CVSS score of 8.8, this flaw represents a significant threat to internal security postures, as it weaponizes the client connection process itself.

Immediate Action: Update all FreeRDP installations to version 3.23.0 or later immediately to incorporate the required bounds checking.

Proactive Monitoring: Monitor RDP connection logs for unusual traffic patterns or unexpected client-side crashes, which may indicate attempted exploitation of the planar decompression path.

Compensating Controls: Restrict RDP client access to trusted, known servers and utilize network-level authentication or VPNs to minimize exposure to potentially malicious RDP hosts.

Public Exploit Available: Unknown

Organizations should prioritize the deployment of FreeRDP version 3.23.0 across all endpoints. Because this vulnerability allows a malicious server to compromise a client during a standard connection, the risk of silent exploitation is significant. Patching is the only effective way to neutralize this threat, and it should be treated as a high-priority maintenance task.