Double-Free Vulnerability in FreeRDP Product by FreeRDP

CVE-2026-64621

What is CVE-2026-64621?

FreeRDP versions prior to 3.28.0 are susceptible to a double-free vulnerability in the freerdp_client_rdp_file_apply_to_settings() function during the parsing of the selectedmonitors field in .rdp files. The issue arises when the MonitorIds array is assigned through the settings object. In a specific error handling scenario, a non-owning pointer to MonitorIds may be freed without clearing it, leading to a dangling pointer. As a result, during the teardown process, the same memory buffer can be improperly released again, which could be exploited by an attacker if the victim opens a specially crafted .rdp file that contains oversized monitor identifiers, potentially leading to critical exploit scenarios in various FreeRDP CLI clients.

References