Code: static void nsc_rle_decode(BYTE* in, BYTE* out, UINT32 originalSize)
 {
 	UINT32 len;
 	UINT32 left;
	BYTE value;
	left = originalSize;

	while (left > 4)
	{
		value = *in++;
 
 		if (left == 5)
 		{
 			*out++ = value;
 			left--;
 		}
		else if (value == *in)
		{
			in++;

			if (*in < 0xFF)
			{
				len = (UINT32) * in++;
				len += 2;
			}
			else
			{
				in++;
				len = *((UINT32*) in);
 				in += 4;
 			}
 
 			FillMemory(out, len, value);
 			out += len;
 			left -= len;
 		}
 		else
 		{
 			*out++ = value;
 			left--;
 		}
 	}
 
	*((UINT32*)out) = *((UINT32*)in);
 }

Vulnerability Type: Exec Code Mem. Corr. 
CWE ID: CWE-787
Summary: FreeRDP prior to version 2.0.0-rc4 contains an Out-Of-Bounds Write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.
Commit Message: Fixed CVE-2018-8788

Thanks to Eyal Itkin from Check Point Software Technologies.