Jeremylaratro

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.22.0 **Description** A heap use-after-free occurs in the Dynamic Virtual Channel (drdynvc) handling path due to improper synchronization of `channel callback` access. A malicious RDP server can trigger a race condition by sending `DYNVC DATA` and `DYNVC CLOSE` messages concurrently, causing the `dvcman channel close` and `dvcman call on receive` functions to access freed memory in the drdynvc client thread. This can lead to a denial of service via a client crash or potentially enable remote code execution within the context of the client process. **Recommendations** Update to version 3.22.0.