CyberRota Analysis
AI-GeneratedFreeRDP server versions prior to 3.31.0 are vulnerable to a use-after-free flaw in the DRDYNVC parser, which can be exploited by authenticated clients to trigger a heap-use-after-free condition. This vulnerability allows attackers to dereference freed channel objects, potentially leading to arbitrary code execution or a denial of service. Organizations using affected FreeRDP server versions should prioritize patching this vulnerability to mitigate the associated risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.