FreeRDP, prior to version 3.21.0, contains a use‑after‑free bug in the X11 graphics pointer handling code. When a client receives a pointer update that fails to allocate the pixel buffer, the code frees the buffer and then frees it again during pointer cleanup, which triggers an undefined behaviour and can lead to a crash or, depending on the heap allocator and layout, to heap corruption with potential code‑execution risk. The flaw is identified as CWE‑416 and exposes the client to denial‑of‑service or remote code execution if exploited. The vulnerability is triggered by a malicious RDP server sending crafted pointer data to a vulnerable client.

FreeRDP clients running any version earlier than 3.21.0 are affected. The project’s release 3.21.0 includes a patch that removes the double free from the pointer handling path. Only the client component that uses X11 graphics is vulnerable; other platforms of FreeRDP are not impacted by this specific bug.

The CVSS score is 7.7, indicating high severity, while the EPSS score is below 1 percent, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need to control an RDP server that can send a specially crafted pointer packet to a vulnerable client, so the attack vector is remote server to client. If exploited, it could cause a crash and potentially allow arbitrary code execution depending on the client’s memory layout and allocator behaviour.