The bug arises from a race condition between the RDPGFX dynamic virtual channel thread and the SDL rendering thread in FreeRDP. During a ResetGraphics operation the SDL surface sdl->primary is freed and the freed pointer is later dereferenced, resulting in a heap use‑after‑free. This flaw can corrupt memory and may allow an attacker to cause program crashes or, in the worst case, execute arbitrary code.

The vulnerability exists in all releases of FreeRDP prior to version 3.20.1. Users running older versions of the FreeRDP client are susceptible. The affected component is the SDL client (sdl->primary) used for rendering RDP desktops.

The CVSS score of 6.9 classifies the weakness as moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at the current time, and the flaw is not listed in the CISA KEV catalog. It is most likely triggered through a remote RDP session that exercises the ResetGraphics routine, though the exact attack vector is inferred from the description. Given the modest CVSS rating and low EPSS probability, the overall risk remains moderate but tangible if an attacker can leverage the race condition.