FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

Summary

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.

Remediation

1. Inventory every FreeRDP FreeRDP deployment, including staging.
2. Upgrade FreeRDP FreeRDP to 3.32.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6wqx-rv3q-vcxp
• Advisoryhttps://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-dynamic-virtual-channel-close