FreeRDP versions before 3.22.0 contain a camera capture thread that, after a device channel is closed, calls a freed channel callback while sending sample responses. This results in a heap use‑after‑free inside the ecam_channel_write function. The flaw can cause the process to crash; depending on the state of the heap, an attacker might gain the ability to execute arbitrary code. The primary weakness is a use‑after‑free (CWE‑416) and an improper handling of return values (CWE‑825).

All FreeRDP installations using versions earlier than 3.22.0 are affected, as the vulnerability was removed in the 3.22.0 release. No information is available indicating that other forks or custom builds are impacted.

The CVSS score of 8.7 indicates a high severity. The reported EPSS score of < 1% suggests that widespread exploitation is currently unlikely, and the CVE is not listed in the CISA KEV catalog. The likely attack vector is an RDP session that utilizes the camera virtual channel, as the flaw is only reached when the capture thread is active. This inference is based on the component involved; no explicit exploitation guidance is provided in the advisory. |The risk to systems depends on whether the vulnerable camera channel is exposed and whether an attacker can initiate an RDP session that triggers the capture thread.