CVE-2026-64621 PUBLISHED

FreeRDP before 3.28.0 Double-Free via selectedmonitors

Assigner: VulnCheck
Reserved: 20.07.2026 Published: 20.07.2026 Updated: 20.07.2026

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor FreeRDP
Product FreeRDP
Versions Default: unaffected
  • affected from 0 to 3.28.0 (excl.)
  • Version 3.28.0 is unaffected

Credits

  • DavidKorczynski reporter

References

Problem Types

  • Double Free CWE