A use‑after‑free vulnerability exists in FreeRDP prior to version 3.23.0. During cleanup, the function that releases a RemoteApp window frees a pointer that has already been freed, which can corrupt heap memory and lead to an application crash. The description implies that an attacker could potentially trigger the flaw by causing the rail window to fail during allocation and then ending the session, which may allow arbitrary memory corruption or denial of service. No confirmed remote code execution is documented.

The affected product is FreeRDP:FreeRDP. All releases older than version 3.23.0 are vulnerable. The vulnerability is tied to the rail component that handles RemoteApp windows in the X11 client build of FreeRDP.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting a very low probability of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to create a Remote Desktop Protocol session that exercises the rail component, cause a title allocation to fail, and then disconnect, after which the dangling pointer is freed again. This scenario implies that exploitation would likely be limited to causing a crash or denial of service rather than providing immediate remote code execution.