FreeRDP up to 3.27.1 RDP File Parser client/common/file.c freerdp_client_rdp_file_apply_to_settings selectedmonitors double free

Summaryinfo

A vulnerability marked as critical has been reported in FreeRDP up to 3.27.1. Affected by this issue is the function freerdp_client_rdp_file_apply_to_settings of the file client/common/file.c of the component RDP File Parser. Performing a manipulation of the argument selectedmonitors results in double free. This vulnerability is identified as CVE-2026-64621. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in FreeRDP up to 3.27.1. This affects the function freerdp_client_rdp_file_apply_to_settings of the file client/common/file.c of the component RDP File Parser. The manipulation of the argument selectedmonitors with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-64621 since 07/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.28.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.27.0
• 3.27.1

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion