FreeRDP implementations before version 3.23.0 contain a heap use‑after‑free flaw in the clipboard handling function xf_clipboard_format_equal. The function reads memory that has already been freed by xf_clipboard_formats_free, which is invoked from the cliprdr channel thread during auto‑reconnect while another thread is iterating the same data. This can corrupt memory and may lead to a crash or, in the worst case, remote code execution if an attacker can control the freed data. The weakness is described as CWE‑416 and the lack of proper synchronization is identified as CWE‑825.

The flaw affects the FreeRDP client application. Any installed instance of the open‑source Remote Desktop Protocol client that runs a version older than 3.23.0 is vulnerable. The issue resides in the X11 clipboard implementation module of the client.

The entry carries a CVSS score of 5.5, indicating moderate impact. The EPSS score is below 1 %, suggesting a low probability of exploitation at this time. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack is most likely triggered when a remote desktop session exchanges clipboard data; a malicious server could potentially trigger the flaw by sending specially crafted clipboard packets. Because the condition depends on concurrent thread activity, the exact exploitation path is non‑trivial, but the defect remains a legitimate risk for systems that rely on the clipboard functionality and has the potential to affect confidentiality, integrity, and availability.