CVE-2026-63652
Received Received - Intake

Use-After-Free in FreeRDP

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-63652
EUVD
EUVD-2026-62671

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freerdp freerdp to 3.28.0 (inc)
freerdp freerdp to 3.28.0 (exc)
freerdp freerdp to 3.27.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63652 is a double-free vulnerability in FreeRDP's rdpsnd server channel, which handles audio output. When processing a malformed Client Audio Formats PDU, the function rdpsnd_server_recv_formats frees memory without clearing the pointer. Later, during session teardown, the same pointer is freed again, causing a crash or heap corruption.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP versions and network traffic for malformed audio format PDUs. Check FreeRDP version with 'xfreerdp --version' or 'apt show freerdp2-x11'. Inspect network traffic for unusual RDP sound channel activity using Wireshark with RDP protocol filters.

Impact Analysis

An authenticated remote attacker can exploit this to cause a denial of service by crashing the FreeRDP server. Depending on the memory allocator, it may also enable heap corruption and potentially allow code execution.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) due to double-free memory corruption in FreeRDP's audio handling. It does not directly expose or leak sensitive data, but service disruption could impact systems processing regulated data. Compliance impact depends on system role and data processed; however, the vulnerability itself does not inherently violate GDPR or HIPAA unless it leads to unauthorized access or data loss during exploitation.

Mitigation Strategies

Upgrade FreeRDP to version 3.28.0 or later immediately. If upgrading is not possible, disable the rdpsnd virtual channel by setting 'rdpsnd=false' in FreeRDP configuration files or command-line arguments. Restrict RDP access through firewalls and VPNs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart