Code: static void nsc_rle_decompress_data(NSC_CONTEXT* context)
 {
 	UINT16 i;
 	BYTE* rle;
 	UINT32 planeSize;
 	UINT32 originalSize;
 	rle = context->Planes;
 
 	for (i = 0; i < 4; i++)
	{
		originalSize = context->OrgByteCount[i];
 		planeSize = context->PlaneByteCount[i];
 
 		if (planeSize == 0)
 			FillMemory(context->priv->PlaneBuffers[i], originalSize, 0xFF);
 		else if (planeSize < originalSize)
			nsc_rle_decode(rle, context->priv->PlaneBuffers[i], originalSize);
 		else
 			CopyMemory(context->priv->PlaneBuffers[i], rle, originalSize);
 
 		rle += planeSize;
 	}
 }

Vulnerability Type: Exec Code Mem. Corr. 
CWE ID: CWE-787
Summary: FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.
Commit Message: Fixed CVE-2018-8788

Thanks to Eyal Itkin from Check Point Software Technologies.