Where is the so called RCE?

[NeoTheCapt]

Very likely to be race condition vulnerability. Double release the resource with a null pointer.

[Spencer]

im not sure i understand your question