What is this vulnerability?

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issue is fixed in version 3.28.0.

How it works

This is classified as CWE-122. In plain terms, an attacker could use this flaw in Freerdp to gain access, disrupt service, or steal data — the exact impact depends on how it’s deployed in your environment.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigations

• Apply the vendor’s security patch or update as soon as it’s available and tested.
• If no patch exists yet, apply the vendor’s temporary workaround.
• Limit network exposure of the affected system until it’s patched.
• Track the vendor advisory — disclosed vulnerabilities can move to active exploitation quickly.

Recommendations

• Confirm whether Freerdp Freerdp is used anywhere in your environment.
• Patch internet-facing systems first, then internal ones.
• Prioritise by exposure and exploitability while a fix is scheduled.
• Subscribe to the vendor’s security advisories for earlier warning next time.