FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow vulnerability in the server-side RAIL channel handler within rail_server_handle_messages() in channels/rail/server/rail_main.c. The flaw arises because the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first validating that orderLength is at least the header length. When orderLength is in the range 0-3, an unsigned integer underflow occurs, producing a very large value that bypasses the Stream_EnsureRemainingCapacity() check via pointer arithmetic wraparound. This oversized value is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this vulnerability to corrupt heap memory and crash the FreeRDP server. The vulnerability has been fixed in FreeRDP version 3.29.0.