An unauthenticated remote attacker can trigger a heap-based buffer overflow in FreeRDP, leading to a denial of service condition.

The vulnerability exists in the crypto_rsa_common function due to an improper bounds check when writing the result of a modular-exponentiation operation. An unauthenticated attacker can exploit this during the RDP Standard Security handshake by providing a crafted ciphertext that overflows the destination heap buffer.

Successful exploitation results in a denial of service, which can disrupt critical remote access capabilities for an organization. With a CVSS score of 9.8, this flaw is highly severe because it impacts the stability of infrastructure providing remote connectivity, potentially leading to significant operational downtime.

Immediate Action: Update FreeRDP to version 3.28.0 or later to ensure the bounds check is correctly applied before memory writes.

Proactive Monitoring: Monitor FreeRDP service logs for frequent crashes or unexpected termination events that may indicate exploitation attempts.

Compensating Controls: Implement network-level filtering to restrict access to RDP services to authorized VPNs or secure gateways, reducing the exposure of the vulnerable service.

Public Exploit Available: Unknown

Given the critical nature of this heap-based overflow, administrators should update all instances of FreeRDP immediately. The absence of authentication requirements makes this a high-priority target for automated scanning and exploitation.