A race condition in FreeRDP’s serial channel IRP thread tracking can cause a heap use‑after‑free. When one thread removes an entry from the serial->IrpThreads list while another thread reads it, an invalid pointer may be dereferenced, which may corrupt memory or cause a crash. The flaw matches CWE‑416 and CWE‑362.

The vulnerability affects all installations of FreeRDP before version 3.20.1. It applies to the open‑source Remote Desktop Protocol implementation distributed under the FreeRDP umbrella.

The CVSS score of 6.8 indicates moderate severity, and an EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is inferred from the description and not directly stated. Practical exploitation would likely require an attacker to initiate a carefully timed RDP session that triggers the serial channel race, requiring concurrent access to the client’s thread pool and precise synchronization of removal and read operations.