The vulnerability is a double‑free bug in FreeRDP’s rdpsnd server channel triggered by a malformed Client Audio Formats PDU. When an authenticated RDP client sends a CBSize that exceeds the remaining payload, the server frees the same memory block twice—once during PDU processing and again during session teardown. This reliably causes the server to crash and can result in allocator‑dependent heap corruption.

The flaw affects FreeRDP server implementations prior to release 3.28.0. Any deployment that accepts authenticated RDP connections and uses the rdpsnd channel for audio redirection is vulnerable. Users running older versions must upgrade to 3.28.0 or later to avoid the issue.

The CVSS score of 7.1 indicates a moderate‑to‑high impact. The EPSS score of 0.00341 (less than 1%) indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, which suggests limited known exploitation. The attack requires an authenticated RDP client, so limiting physical or network access to RDP services reduces the threat. Because the vulnerability can terminate the service and introduce heap corruption, applying the 3.28.0 fix is necessary.