FreeRDP clients before version 3.29.0 can suffer a client‑side use‑after‑free bug when asynchronous update is enabled (for example, xfreerdp /async-update). The vulnerability is triggered by a WINDOW_ICON_ORDER message that copies a pointer into a new structure and later frees it while the old message remains queued. When that stale pointer is later delivered the client dereferences freed memory, resulting in memory corruption which may cause the client to crash. This weakness matches CWE-416 and is documented as a high‑severity heap corruption issue.

All installations of FreeRDP older than 3.29.0 that enable async update are affected. This includes any client that runs the FreeRDP binaries with the /async-update flag or that otherwise allows asynchronous WINDOW_ICON_ORDER messages from the server.

The CVSS score of 8.7 reflects the high impact of the bug. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires a malicious or compromised RDP server to send a crafted RAIL Window Alternate Secondary Order with WINDOW_ORDER_ICON; the likely attack vector is remote through the RDP protocol. While the impact is primarily a client crash and memory corruption, the vulnerability could potentially be leveraged for arbitrary code execution if the attacker can control the data, but no evidence of such exploitation is reported.