FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData is present, clear_decompress calls freerdp_image_copy_no_overlap without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
2.10.0+dfsg1-12.10.0+dfsg1-1.12.10.0+dfsg1-1~bpo11+12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp22.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-3+22 more2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp22.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-4+3 more3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-1+5 moreExploitability
AV:NAC:LAT:NPR:NUI:NVulnerable System
VC:NVI:NVA:HSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X