FreeRDP has a heap‑use‑after‑free flaw in the SDL2 implementation of the update_pointer_new routine. The bug occurs because a pointer is freed without being nulled, so the freed memory can later be dereferenced. This flaw, identified as CWE‑416 and CWE‑825, can lead to memory corruption or application crashes. Based on the description, it is inferred that the likely attack vector is local exploitation of the client application, such as an attacker supplying malicious pointer data or triggering the update through a user interface action.

The vulnerability affects all FreeRDP versions prior to 3.23.0 that use the SDL2 code path. Any client or server installation running a pre‑3.23.0 FreeRDP binary with SDL2 enabled is at risk. Builds that use the newer SDL3 path are not subject to the flaw.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation would require the attacker to cause the vulnerable application to dereference the freed pointer, likely by manipulating pointer data or triggering a specific UI action within a locally running client. Because the flaw resides in client‑side code, remote exploitation via the network is not clearly supported, making local privilege escalation or denial of service the most probable impacts.