FreeRDP’s RAIL channel contains a heap‑use‑after‑free in the function xf_SetWindowMinMaxInfo. The flaw occurs when a window is deleted by the main thread while a separate RAIL server thread still accesses the freed xfAppWindow structure, causing an invalid memory dereference. This memory corruption can result in an application crash. The potential for code execution is not explicitly documented; based on typical heap corruption effects, it is inferred that an attacker could possibly trigger arbitrary code execution if the crash is exploitable, but this claim is tentative.

All FreeRDP releases before version 3.23.0 that include the xf_rail code are vulnerable. The issue resides in the client component that handles RAIL window min/max data and affects any system that accepts remote clients with the RAIL channel enabled.

The base CVSS score is 5.5, indicating moderate severity. The EPSS score of <1% reflects a very low probability of exploitation at the time of analysis. Because the flaw is exercised through the RAIL channel during a remote desktop session, it is inferred that an attacker must establish a RAIL‑enabled session and trigger window min/max updates while a window is removed. The vulnerability is not listed in CISA’s KEV catalog, so it has not been confirmed as a publicly exploited flaw. Administrators should consider the moderate impact and low exploitation likelihood when prioritizing remediation.