CVE-2026-64621 in FreeRDP
Summary
by MITRE • 07/20/2026
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability under examination represents a critical double-free condition within FreeRDP versions prior to 3.28.0, specifically affecting the 3.x release line through 3.27.1. This flaw manifests in the freerdp_client_rdp_file_apply_to_settings() function located in client/common/file.c, where improper memory management during RDP file parsing creates a path for remote code execution through crafted malicious input. The vulnerability stems from inadequate handling of the selectedmonitors field within .rdp connection files, which directly impacts how monitor identification arrays are processed and subsequently freed.
The technical implementation of this flaw involves the MonitorIds array allocation through the settings object followed by a non-owning pointer dereference during error handling paths. When the strtoul parsing operation encounters oversized monitor tokens, the code executes a free operation on the MonitorIds buffer without properly clearing the settings->MonitorIds pointer reference. This creates a dangling pointer condition where the same memory region gets freed twice during the application's teardown phase. The first free occurs during the error path when parsing fails, while the second free happens in freerdp_settings_free() during normal program termination, resulting in a controlled double-free scenario.
This vulnerability operates with significant operational impact as it can be exploited through simple crafted .rdp files delivered via social engineering or automated attack vectors. The default configuration of FreeRDP CLI clients including xfreerdp, sdl-freerdp, and wlfreerdp makes this attack surface particularly broad since these are commonly used in enterprise environments for remote desktop connections. Attackers can leverage this issue to potentially execute arbitrary code with the privileges of the affected application process, making it a severe threat vector for both privilege escalation and remote code execution scenarios. The memory corruption resulting from the double-free opens possibilities for heap spraying techniques and memory layout manipulation that could be exploited further.
The vulnerability maps directly to CWE-415: Double Free within the Common Weakness Enumeration catalog, which specifically addresses the condition where a pointer is freed twice, leading to undefined behavior and potential exploitation. From an ATT&CK framework perspective, this represents a privilege escalation opportunity through code injection techniques, potentially classified under T1068: Exploitation for Privilege Escalation and T1566: Phishing with Malicious Attachments for initial compromise vector. The exploitation requires minimal user interaction since simply opening a malicious .rdp file triggers the vulnerable code path, making it particularly dangerous in targeted attack scenarios where adversaries can leverage social engineering to deliver these crafted files.
Mitigation strategies must focus on immediate version upgrades to FreeRDP 3.28.0 or later where the double-free condition has been resolved through proper memory management implementation. Organizations should implement strict file validation policies for .rdp files, particularly when they originate from untrusted sources, and consider deploying network-based intrusion detection systems that can identify suspicious RDP file content patterns. Additionally, implementing sandboxing mechanisms around FreeRDP client execution environments can limit the potential impact of successful exploitation attempts. Security teams should also monitor for any indicators of compromise related to these specific vulnerable versions and ensure proper patch management procedures are in place to prevent unauthorized execution of potentially malicious .rdp files within their environments.