FreeRDP’s RDPEAR NDR parser incorrectly handles pointer ref‑ids, allowing a malicious Remote Desktop server to reuse the same ref‑id across multiple pointer fields. The parser allocates the same heap object for both fields, and the subsequent destructor frees that object twice, creating a heap use‑after‑free or double‑free. An attacker can exploit this flaw to corrupt the client’s memory and potentially execute arbitrary code while the user is authenticating to an RDP session. The weakness is a classic double‑free error (CWE‑415) and a use‑after‑free scenario (CWE‑416).

All versions of the FreeRDP client older than 3.26.0 are affected. The product is the FreeRDP Remote Desktop client, provided by the open‑source FreeRDP project. No other vendors or product lines are listed as impacted.

The CVSS score of 7.5 denotes medium‑to‑high severity. The EPSS score is not available, indicating no publicly known recent exploitation trend, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: a malicious RDP server that sends an authentication‑redirection request can trigger the flaw during the client’s parsing of the RDPEAR message. Successful exploitation would require the client to be connected to a server that is controlled by an attacker and that sends crafted data. Once triggered, the attacker could achieve code execution or other memory corruption effects on the client machine.