FreeRDP versions prior to 3.26.0 contain a heap-buffer-overflow vulnerability in the gdi_CacheToSurface function. A malicious RDP server can exploit this by sending crafted RDPGFX PDUs to clients with RDPGFX enabled. The vulnerability occurs due to improper validation of destination rectangles, where validation is performed on clamped values but the copy operation uses original cacheEntry dimensions. This can result in large out-of-bounds heap writes, potentially leading to client crashes or arbitrary code execution. The vulnerability has been patched in FreeRDP version 3.26.0.