CVE-2026-64621 Details
Description
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
A double-free vulnerability has been identified in FreeRDP versions prior to 3.28.0, specifically in the 3.x series through 3.27.1. The issue arises in the function 'freerdp_client_rdp_file_apply_to_settings()' within 'client/common/file.c', when the 'selectedmonitors' field of a .rdp connection file is parsed. The vulnerability occurs because the 'MonitorIds' array is allocated through the settings object, and a raw, non-owning pointer to it is freed on the 'strtoul' error path without clearing 'settings->MonitorIds', leaving the pointer dangling. During the teardown process, 'freerdp_settings_free()' inadvertently frees the same buffer again, leading to a double-free condition. This vulnerability can be exploited by an attacker who convinces a victim to open a crafted .rdp file containing oversized monitor tokens, triggering the double-free in any FreeRDP CLI client (such as xfreerdp, sdl-freerdp, or wlfreerdp) under default configuration.
Users can upgrade to FreeRDP version 3.28.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/1f7a716d39b5605bb8a83b0c3c97a6ce386609ef | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc | [email protected] | ExploitMitigationVendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-double-free-via-selectedmonitors | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | >= 3.0.0, < 3.28.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |