The vulnerability in FreeRDP prior to version 3.29.0 is a client-side heap use-after-free triggered in the asynchronous update message proxy handling WINDOW_ICON_ORDER messages when AsyncUpdate is enabled (e.g., using xfreerdp with /async-update). The issue arises because update_message_WindowIcon() performs a shallow CopyMemory() that replaces a newly allocated lParam->iconInfo with a pointer owned by the parser (windowIcon->iconInfo). After the parser callback completes, update_recv_window_info_order() frees the window_icon.iconInfo memory, but the queued asynchronous message still holds a stale pointer to this freed memory. If a malicious or compromised RDP server sends a specially crafted RAIL Window Alternate Secondary Order containing WINDOW_ORDER_ICON, it can trigger this use-after-free, leading to memory corruption and a client crash. The CVSS 3.1 score is 7.5 (high severity), reflecting the network attack vector with no privileges or user interaction required, and causing availability impact.

Exploitation of this vulnerability allows a remote attacker controlling an RDP server to cause a use-after-free condition in the FreeRDP client, resulting in memory corruption and a client crash. This impacts the availability of the client application but does not directly affect confidentiality or integrity according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the AsyncUpdate feature (e.g., avoid using the /async-update option) to mitigate the risk of exploitation. Monitor vendor channels for updates and apply patches promptly once released.