FreeRDP suffers from a use‑after‑free bug in the function ainput_send_input_event. The bug occurs when channel_callback is cached without synchronization; a concurrent channel close can free or reinitialize the callback, causing a use‑after‑free that can lead to memory corruption. An attacker who can trigger input events over a remote desktop session can exploit this flaw to potentially execute arbitrary code or crash the client, impacting confidentiality, integrity, or availability.

This vulnerability affects the FreeRDP project across all platforms supported by the open‑source implementation. Versions older than 3.22.0 are susceptible; the fix is incorporated in 3.22.0 and later releases.

The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% reflects a low current exploitation probability. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker could exploit the vulnerability remotely by establishing an RDP session and invoking input events that trigger the freed callback. Because the exploit requires a live session and coordination of channel state, the attack vector is inferred to be remote RDP.