FreeRDP versions prior to 3.26.0 contain a heap use-after-free and double-free vulnerability in the RDPEAR NDR parser. The parser incorrectly handles non-null NDR pointer ref-ids, allowing the same reference ID to be reused across multiple pointer fields without proper tracking. This results in the same heap object being assigned to multiple output fields, which the generic destructor later attempts to free multiple times. A malicious RDP server can trigger this vulnerability in the client's RDPEAR authentication-redirection path, potentially leading to memory corruption. The vulnerability has been fixed in FreeRDP version 3.26.0.