The flaw is a heap‑use‑after‑free in the FreeRDP client’s window update routine. A cached XImage continues to reference a surface buffer that has already been freed because the surface delete routine does not clear the aliasing pointer. If an attacker can control RDP graphics data, the client may read or write to unintended memory, leading to crashes, memory corruption, or even arbitrary code execution in rare circumstances.

The vulnerability is present in the FreeRDP client implementation. All releases older than 3.23.0 are affected and may run into the stale XImage reference bug. The affected product is FreeRDP:FreeRDP, and users deploying any version prior to 3.23.0 could be impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur through a remote RDP client that sends crafted graphics updates, triggering the use‑after‑free and causing a crash or memory corruption. Denial of service is the most probable outcome, with a small risk of more severe memory corruption if the attacker has sufficient control over the graphics buffer.