FreeRDP before version 3.32.2 contains a use‑after‑free flaw in the rdpgfx dynamic virtual channel. A duplicate‑name channel with a new ChannelId overwrites the listener’s callback slot, and the rdpgfx_on_close function frees the channel without clearing it. A malicious RDP server can exploit this by opening and closing such a channel, then sending a protocol data unit on the original channel, which can crash the client or potentially run arbitrary code.

All installations of FreeRDP released before 3.32.2 are affected. The vulnerability is present in the client component of FreeRDP when the rdpgfx dynamic virtual channel is enabled. No specific runtime environment or configuration is required beyond being a client that accepts RDP connections.

The flaw scores a 9.3 on CVSS, indicating a severe risk. Because the EPSS score is not available and it is not listed in the CISA KEV catalog, no global exploitation data is presently reported, but the attack vector is inferred to be a remote RDP server. The exploit requires that an attacker can initiate an RDP session with the vulnerable client; once connected, the attacker can trigger the channel manipulation described above, leading to a crash or code execution on the client machine.