FreeRDP prior to version 3.22.0 contains a heap use‑after‑free in the urb_write_completion path, triggered when an asynchronous bulk transfer completion references a channel callback that has already been freed after a URBDRC channel close. The flaw allows an attacker to read or write arbitrary memory, potentially resulting in arbitrary code execution. The vulnerability is categorized as CWE‑416 and relates to heap corruption.

The affected product is the FreeRDP client implementation of the Remote Desktop Protocol. All releases before version 3.22.0 are impacted. No vendor‑specific variants are listed beyond the upstream Open‑Source FreeRDP project.

The CVSS score of 8.7 denotes a high severity, while the EPSS score of less than 1% suggests the chance of widespread exploitation is currently low. The flaw is not present in the CISA Know‑Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a malicious remote session in which an attacker can send specially crafted bulk transfer requests after a channel has been closed, which requires remote access to the vulnerable FreeRDP instance. Successful exploitation could lead to arbitrary code execution on the client host.