FreeRDP includes a function that frees a device configuration on error but continues to dereference the freed object in later code. The use‑after‑free flaw in urb_select_interface allows an attacker to cause memory corruption during a Remote Desktop session, potentially leading to arbitrary code execution or denial of service when a user connects with a vulnerable client. The vulnerability is rooted in CWE‑416 and CWE‑825.

Vendors including FreeRDP directly. All installations of FreeRDP versions earlier than 3.22.0 are affected, regardless of operating system, because the flaw is in the core library. Upgrading to version 3.22.0 or later resolves the issue.

The flaw has a CVSS score of 7.7, indicating high severity, but the exploit probability as measured by EPSS is below 1%, suggesting that attackers are unlikely to be actively targeting it currently. It is not listed in the CISA KEV catalog, so there are no known live exploits at this time. The threat is realistic if an attacker can influence the victim's RDP session to trigger the error path, which is possible when USB device forwarding is enabled. However, the narrow exploit window and low current exploitation likelihood mean that organizations with older FreeRDP deployments should assess the risk, monitor for related activity, and prioritize remediation.