FreeRDP contains a heap use‑after‑free flaw in the RAIL channel when resizing or moving windows. If the main thread deletes a window while the RAIL thread still accesses its structure, the code dereferences a freed pointer, which can corrupt memory or trigger a crash. This vulnerability is classified as CWE‑416 and CWE‑825, and the possible impact is loss of availability and potential memory corruption. The official description does not state that data leakage or remote code execution is possible; any such effect is inferred and not explicitly asserted in the advisory.

The flaw is present in all FreeRDP releases prior to version 3.23.0. Any system running the FreeRDP client component with the RAIL channel enabled is affected, regardless of the operating system. The issue is limited to the client side; the server side is not impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: a malicious RDP client could send crafted RAIL channel messages that trigger concurrent deletion of a window while the server continues to process a move or resize request. Successful exploitation would likely result in a crash or memory corruption but does not provide remote code execution under the conditions described. These attack assumptions are inferred from the described concurrency issue and are not directly stated in the advisory.