FreeRDP employs a heap‑based use‑after‑free bug when processing SDL pointer updates. During sdl_Pointer_New a failure triggers a free, after which pointer_free attempts to free the same object again, leading to an ASan reported UAF. This flaw fits CWE‑416 and CWE‑825 and may allow a remote RDP client to corrupt memory, potentially executing arbitrary code on the target system.

The flaw affects the FreeRDP open‑source RDP implementation before version 3.22.0. Users of any FreeRDP package that includes the SDL pointer handling path are vulnerable. The issue was addressed in release 3.22.0; the commit that contains the fix is referenced in the advisory.

The CVSS score is 8.7, indicating a high‑severity vulnerability, while the EPSS probability is below 1% and the flaw is not in the CISA KEV list. Attackers could trigger the use‑after‑free by sending crafted pointer update messages from a remote RDP session or by exploiting a vulnerable client connecting to a target. Successful exploitation requires remote connectivity to the vulnerable program and the ability to induce the fault condition during pointer handling.