CVE-2026-64621

NameCVE-2026-64621
DescriptionFreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
freerdp2 (PTS)bullseye2.3.0+dfsg1-2+deb11u1vulnerable
bullseye (security)2.3.0+dfsg1-2+deb11u3vulnerable
bookworm2.11.7+dfsg1-6~deb12u1vulnerable
freerdp3 (PTS)trixie3.15.0+dfsg-2.1+deb13u3vulnerable
forky, sid3.30.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
freerdp2source(unstable)(unfixed)
freerdp3source(unstable)3.28.0+dfsg-1

Notes

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc

Search for package or bug name: Reporting problems