FreeRDP versions earlier than 3.22.0 contain a heap‑use‑after‑free flaw in the video_timer component. When the control channel is closed, video_timer may send client notifications that reference a callback pointer that has already been freed, causing an invalid memory dereference. The affected code can potentially allow an attacker to inject arbitrary code or crash the client, resulting in loss of confidentiality, integrity, or availability.

The vulnerable product is the FreeRDP implementation of the Remote Desktop Protocol. Any FreeRDP client older than version 3.22.0 is affected; the issue is fixed in 3.22.0 and later.

The CVSS score of 7.7 indicates a high risk of code execution or denial of service. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild, and the entry is not listed in the CISA KEV catalog. Based on the description, the buggy behavior is triggered after a control channel is closed, so a remote attacker who can send crafted RDP traffic to the vulnerable client is likely required to trigger the use‑after‑free. The impact is limited to the client process; successful exploitation would compromise the host running the client.