FreeRDP versions prior to 3.33.0 contain a heap use‑after‑free flaw in the functions update_gdi_patblt(), update_gdi_polygon_cb(), and update_gdi_mem3blt(). The flaw arises when a stale pointer to a brush cache element is retained; a malicious RDP server can send a CACHE_BRUSH command to reuse the same cache slot followed by a PATBLT command, which causes the client to dereference freed heap memory. Accessing this memory can expose sensitive data or terminate the client process, resulting in a denial of service.

All installations of FreeRDP older than 3.33.0 are affected, including release 3.32.2 and earlier. The vulnerability applies to every client that connects to an RDP server using the legacy brush caching mechanism.

The CVSS score of 5.3 indicates moderate severity, but the exploitability remains high because a remote RDP server can trigger it at will. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can control the RDP server side can send the specific cache and blt commands to coerce the client into reading freed memory, thereby leaking data or causing a crash.