FreeRDP’s client code contains a heap‑use‑after‑free bug that can be triggered when the RDPGFX data‑channel thread accesses a window pointer after the main thread has deleted the window. Because the freed memory is then read, an attacker could arrange a sequence of RDP operations that causes a crash or, in the worst case, memory corruption that permits arbitrary code execution. The vulnerability is classified as CWE‑416 and CWE‑825.

The flaw affects FreeRDP implementations older than version 3.23.0. The affected product is FreeRDP, a free RDP client accessible on multiple operating systems. All builds that use the xf_rail component before the 3.23.0 release are subject to this bug. The vendor designated the affected version range as <3.23.0.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score indicates exploitation probability is below 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the bug is triggered through remote desktop traffic, so the likely attack vector is an attacker who can send specially crafted RDP requests that trigger concurrent window update and deletion events. No public exploit code is known, so the risk primarily manifests as a potential denial‑of‑service or memory corruption event if the attacker can orchestrate the required packet sequence.