FreeRDP before version 3.32.2 contains a use‑after‑free flaw in the asynchronous dynamic rdpsnd channel; an attacker can send a training PDU, close the channel while queued audio PDUs are still being processed, and thereby cause the playback thread to dereference a freed callback in rdpsnd_virtual_channel_write, leading to a client crash. This flaw reflects a concurrency control weakness identified by CWE-362. The vulnerability does not provide remote code execution or privilege escalation – the impact is limited to denial of service for the affected RDP client.

All instances of the FreeRDP client older than version 3.32.2 are affected. The vulnerable product is FreeRDP:FreeRDP. No specific sub‑versions are listed, so the risk applies to every release before 3.32.2.

The CVSS score of 8.2 indicates high severity. The exploit requires an attacker who can act as an RDP server or who can inject malicious PDUs into the client session; a malicious server can trivially trigger the crash by closing the channel after sending a queued audio PDU. EPSS data is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet, though the high CVSS and ease of triggering mean that it should be treated as a significant risk to client availability.