FreeRDP 3.32.0 contains a use-after-free flaw in the Dynamic Virtual Channel (drdynvc) implementation. When a malicious RDP server sends a single carefully crafted Virtual Channel Protocol Data Unit (PDU) with a totalLength smaller than the expected chunk size, the client frees a memory stream that is still in use, causing a crash during teardown. The CVSS score of 7.1 reflects the high severity of a denial‐of‐service condition that can be triggered remotely. This vulnerability falls under CWE‑416.

The affected product is FreeRDP itself, specifically the 3.32.0 release. No other product or version information is listed. Users running this version of FreeRDP as an RDP client are exposed.

An attacker who can initiate or control an RDP session with a vulnerable client can exploit this flaw by sending the single malicious PDU described. Because the required input is a well‑formed Virtual Channel PDU, an attacker can trigger the crash from a remote location without local privileges. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the remote nature of the attack and the client crash make it a significant denial‑of‑service risk for any environment relying on FreeRDP 3.32.0.