PT-2026-137010

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can...