Out-of-bounds read via integer overflow

Integer overflow in FreeRDP before 3.27.0 allows remote attackers to trigger an out-of-bounds read via crafted RAIL icon updates. In freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c, the cbBitsColor check multiplies nWidth, nHeight, and bytes per pixel in 32-bit arithmetic, so large TS_ICON_INFO dimensions wrap the required-size calculation and let freerdp_image_copy_no_overlap read past the supplied icon buffer. Reachability is limited to RemoteApp clients that traverse the vulnerable library path against a malicious RDP server; desktop sessions are excluded and xfreerdp has a caller-side mitigation, so the disclosed impact is bounded to client-side memory disclosure or service interruption.