FreeRDP 3.29.0 before 3.32.0 contains a double free in the client’s async‑update message proxy. The flaw is triggered when the client processes a polygon order that contains points followed by a zero‑point order. This double free can cause a crash of the RDP client, leading primarily to a denial of service. The vulnerability does not provide direct code execution or data exfiltration, but a malicious RDP server can exploit it to disrupt client availability.

The affected product is the FreeRDP client. Versions 3.29.0 through 3.31.x are vulnerable. The vendors listed by the CNA are FreeRDP:FreeRDP. No additional product versions are disclosed.

The vulnerability has a CVSS score of 7.1, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The exploit requires a malicious RDP server that can send the specific polygon order sequence; the attack does not require privileged local access or user interaction. Successful exploitation will cause a crash of the client, leading to denial of service.