A heap buffer overflow exists in FreeRDP versions 3.28.0 and earlier within the server-side RAIL channel handler function rail_server_handle_messages(). The vulnerability occurs because the code subtracts the constant RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without verifying that orderLength is at least the header length. For orderLength values between 0 and 3, this subtraction causes an unsigned integer underflow, resulting in a very large size value. This bypasses the Stream_EnsureRemainingCapacity() check due to pointer arithmetic wraparound and leads to an out-of-bounds heap write via WTSVirtualChannelRead(). A malicious or compromised RDP client can exploit this flaw to corrupt the heap and crash the server. The issue is addressed in FreeRDP version 3.29.0.

Exploitation of this vulnerability allows a remote attacker, acting as a malicious or compromised RDP client, to cause a denial of service by crashing the FreeRDP server due to heap corruption. There is no indication from the provided data that confidentiality or integrity are impacted. The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

A fix is available in FreeRDP version 3.29.0. Users and administrators should upgrade to version 3.29.0 or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the vulnerability description stating the issue is fixed in 3.29.0.