FreeRDP before version 3.28.0, specifically versions 3.x through 3.27.1 and numerous earlier Ubuntu package versions, contains a double-free vulnerability. This flaw arises from improper handling of memory deallocation, which can lead to memory corruption. The vulnerability is exploitable remotely without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this double-free vulnerability can lead to high impact on confidentiality, integrity, and availability of the affected system. An attacker could cause a denial of service or potentially execute arbitrary code remotely without any privileges or user interaction.

A fix is available in FreeRDP version 3.28.0 and later. Users and administrators should upgrade affected FreeRDP installations to version 3.28.0 or newer to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Check vendor advisories and Ubuntu security updates for the appropriate patched package versions.