The vulnerability in FreeRDP prior to version 3.22.0 arises from a use-after-free condition caused by improper synchronization when accessing channel_callback in the dvcman_channel_close and dvcman_call_on_receive functions. A malicious RDP server can exploit a race condition by concurrently sending DYNVC_DATA and DYNVC_CLOSE messages, triggering heap-use-after-free in the drdynvc client thread. This flaw potentially enables remote code execution or denial of service on the client side.

Successful exploitation can lead to heap-use-after-free conditions in the FreeRDP client, which may result in remote code execution or denial of service. The vulnerability is exploitable remotely by a malicious RDP server without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ubuntu and FreeRDP advisories for updates and apply patches once available to address this vulnerability.