FreeRDP creates a use‑after‑free condition when a channel callback is accessed concurrently in the dvcman_channel_close and dvcman_call_on_receive functions. A malicious RDP server can trigger a race by sending DYNVC_DATA and DYNVC_CLOSE messages at the same timefree in the drdynvc client thread. The flaw is a classic concurrency flaw (CWE‑362) and can potentially allow an attacker to execute arbitrary code on the client or cause a denial of service.

All FreeRDP deployments running a version earlier than 3.22.0 are affected. The issue is present in any installation that enables dynamic virtual channels (DYNVC) and does not perform proper synchronization on channel callbacks. This includes typical RDP client setups that rely on FreeRDP libraries for remote desktop connections.

The vulnerability carries a CVSS score of 8.3, indicating a high severity risk. The EPSS score is less than 1%, indicating a very low but non-zero exploitation probability, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a remote client connecting to a malicious RDP server that intentionally spawns the race condition, which could lead to remote code execution or service disruption on the client machine.