FreeRDP before version 3.32.2 suffers a use‑after‑free triggered by a race condition within the DRDYNVC tracker while handling the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU messages for an active channel identifier, which races with the front‑end data handling to free a borrowed context. When the context is freed the proxy process crashes, resulting in a denial of service. Though the fault is a use‑after‑free, the official description notes only a crash as the impact.

The vulnerability affects the FreeRDP product, all releases older than 3.32.2, specifically the proxy component that processes the drdynvc channel. Users of FreeRDP proxy services must upgrade to 3.32.2 or newer to remove the flaw.

The CVSS score of 8.2 indicates a high risk, and the lack of an EPSS value or KEV listing suggests that no widespread exploitation has been reported yet. The attack requires remote access to the FreeRDP proxy over the RDP protocol and the ability to send crafted CREATE_REQUEST_PDU packets. A malicious target server could use repeated CREATE_REQUEST_PDU messages to race with the front‑end data handling and crash the proxy. While the bug is a use‑after‑free and could hypothetically lead to code execution if an attacker also manipulates memory state, the disclosed impact is a denial of service. Consequently, the risk remains high and should be mitigated promptly.