CVE-2026-64621: FreeRDP before 3.28.0 Double-Free via selectedmonitors
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdpclientrdpfileapplytosettings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdpsettingsfree() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP (xfreerdp/sdl-freerdp/wlfreerdp)to a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64621?
CVE-2026-64621 has a high severity rating of 7.3.
How do I fix CVE-2026-64621?
To remediate CVE-2026-64621, upgrade FreeRDP to version 3.28.0 or later.
What causes the vulnerability in CVE-2026-64621?
CVE-2026-64621 is caused by a double-free vulnerability in the parsing of the selectedmonitors field in .rdp connection files.
Which versions of FreeRDP are affected by CVE-2026-64621?
FreeRDP versions from 3.x through 3.27.1 are affected by CVE-2026-64621.
What impact could CVE-2026-64621 have on an affected system?
CVE-2026-64621 could lead to memory corruption, potentially allowing an attacker to execute arbitrary code.