Heap Corruption Vulnerability in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-63652

What is CVE-2026-63652?

FreeRDP, an open-source implementation of the Remote Desktop Protocol, contains a vulnerability in the handling of Client Audio Formats PDUs. Specifically, prior to version 3.28.0, the function rdpsnd_server_recv_formats can inadvertently free the client_formats on malformed audio data without sanitizing the owning pointer or the count of client formats. This flaw may be exploited by an authenticated RDP client, leading to an Error causing a cbSize value that exceeds the remaining record size. This results in a dangling pointer issue within the server context, allowing the potential for double-free conditions when rdpsnd_server_context_free is called during session termination. Such exploitation can lead to unreliable server termination and allocator-dependent heap corruption, posing significant risks to the system’s integrity.

References