CVE-2026-64621
Received Received - Intake

Double-Free in FreeRDP Client

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64621
EUVD
EUVD-2026-45936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.27.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64621 is a double-free vulnerability in FreeRDP versions 3.x through 3.27.1. It occurs when parsing a malformed selectedmonitors field in a .rdp connection file. The MonitorIds array is allocated via settings but freed incorrectly on an error path without clearing the pointer, leaving it dangling. During teardown, the same buffer is freed again, causing a double-free condition.

Detection Guidance

Check FreeRDP version with 'xfreerdp --version' or 'freerdp2 --version'. If using versions 3.x through 3.27.1, the system is vulnerable. Inspect .rdp files for malformed selectedmonitors fields with oversized tokens like '99999999999999999999999'.

Impact Analysis

An attacker can exploit this by tricking a victim into opening a crafted .rdp file with oversized monitor tokens. This triggers a double-free in FreeRDP CLI clients like xfreerdp, potentially leading to heap corruption, crashes, or further exploitation. The attacker controls freed chunk size, enabling overlapping allocation primitives.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. However, if exploited, it could lead to unauthorized remote access or data exfiltration, which may violate confidentiality requirements under these regulations. The impact depends on the specific use case and data processed by FreeRDP.

Mitigation Strategies

Upgrade FreeRDP to version 3.28.0 or later immediately. Avoid opening untrusted .rdp files. If upgrading is not possible, disable all FreeRDP CLI clients or restrict access to .rdp files from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart