CVE-2026-63652: FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context->clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsndservercontextfree to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
FreeRDP versions prior to 3.28.0 that operate an RDP server and process the rdpsnd server channel are affected. The issue is fixed in FreeRDP 3.28.0.
What access does an attacker need?
An attacker must be an authenticated RDP client. They can send a malformed Client Audio Formats PDU, such as one containing a cbSize value larger than the remaining record.
What is the expected impact of successful exploitation?
The double-free reliably terminates the server at session teardown. Depending on allocator behavior, it can also result in heap corruption.
Is a workaround available when an immediate upgrade is not possible?
The provided information identifies upgrading to version 3.28.0 as the fix. It does not describe a configuration-based workaround or other mitigation for unpatched deployments.