CVE-2026-63652 Overview
CVE-2026-63652 is a double free vulnerability [CWE-415] in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in rdpsnd_server_recv_formats within channels/rdpsnd/server/rdpsnd_main.c. When the server receives a malformed Client Audio Formats Protocol Data Unit (PDU), it frees context->client_formats without clearing the owning pointer or resetting num_client_formats. An authenticated RDP client can trigger this condition and leave a dangling pointer in the server context. At session teardown, rdpsnd_server_context_free frees the same allocation again, terminating the server and enabling allocator-dependent heap corruption. The issue is fixed in FreeRDP version 3.28.0.
Critical Impact
An authenticated RDP client can crash the FreeRDP server and potentially trigger heap corruption through a crafted Client Audio Formats PDU.
Affected Products
- FreeRDP versions prior to 3.28.0
- Applications embedding the FreeRDP server library with the rdpsnd channel enabled
- Remote desktop deployments exposing FreeRDP-based server endpoints
Discovery Timeline
- 2026-08-19 - CVE-2026-63652 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-63652
Vulnerability Analysis
The vulnerability is a classic double free [CWE-415] in the FreeRDP audio redirection server channel. The function rdpsnd_server_recv_formats parses a Client Audio Formats and Version PDU (section 2.2.2.2 of the RDP audio specification). When the parser detects a malformed field, such as a cbSize value exceeding the remaining record length, it releases the client_formats buffer through free(). The code path does not nullify context->client_formats and does not reset context->num_client_formats. The stale pointer remains valid in the server context structure.
When the RDP session terminates, rdpsnd_server_context_free iterates the context state and frees client_formats a second time. This produces a double free against the heap allocator, which reliably kills the server process. Depending on allocator internals such as glibc ptmalloc tcache or jemalloc arenas, the double free may be leveraged for heap metadata corruption.
Root Cause
The root cause is an incomplete error handling path. The parser frees an allocation on the malformed input branch but fails to invalidate its owner reference in the server context. The lifecycle contract that only owner code should free the buffer is broken.
Attack Vector
Exploitation requires an authenticated RDP session with the rdpsnd static virtual channel negotiated. The attacker sends a crafted Client Audio Formats PDU with an invalid cbSize or truncated record. The attacker then closes the session to trigger the second free during context teardown.
return CHANNEL_RC_OK;
}
+static void rdpsnd_server_client_format_free(RdpsndServerContext* context)
+{
+ WINPR_ASSERT(context);
+ free(context->client_formats);
+ context->client_formats = nullptr;
+ context->num_client_formats = 0;
+}
+
/**
* Read Client Audio Formats and Version PDU (2.2.2.2)
*
Source: FreeRDP commit caf653c
The patch introduces a dedicated helper that frees the buffer, sets the pointer to nullptr, and zeros the format count. This prevents subsequent free calls from operating on the stale allocation.
Detection Methods for CVE-2026-63652
Indicators of Compromise
- Unexpected crashes or SIGABRT signals in FreeRDP server processes handling active RDP sessions
- Heap corruption diagnostics from glibc such as double free or corruption messages in system logs
- Abrupt termination of RDP server workers immediately after client disconnect events
Detection Strategies
- Inventory FreeRDP-based server components and confirm the running version against 3.28.0
- Inspect rdpsnd channel traffic for malformed Client Audio Formats PDUs with inconsistent cbSize values
- Correlate authenticated RDP session teardown events with server process restarts to identify triggering clients
Monitoring Recommendations
- Enable core dump collection on FreeRDP server hosts to capture double free crashes for forensic analysis
- Forward RDP authentication logs and process crash telemetry to a centralized data lake for correlation
- Alert on repeated crash-restart cycles tied to a single authenticated RDP principal or source IP
How to Mitigate CVE-2026-63652
Immediate Actions Required
- Upgrade FreeRDP server components to version 3.28.0 or later across all affected hosts
- Restrict RDP server exposure to trusted networks and enforce strong authentication for all RDP principals
- Audit deployments that link the FreeRDP server library and rebuild them against the patched release
Patch Information
The fix is available in FreeRDP 3.28.0. The patch is applied in commit caf653c0ba1c75ec8f298d1baa59770102a5d14c, which introduces rdpsnd_server_client_format_free to consistently clear client_formats and num_client_formats after free. See the FreeRDP Security Advisory GHSA-9g22-w2gr-vcmp, the merged pull request #12993, and the FreeRDP 3.28.0 release notes for full details.
Workarounds
- Disable the rdpsnd static virtual channel in server configuration if audio redirection is not required
- Limit RDP accounts to trusted users to reduce the pool of clients able to reach the vulnerable code path
- Place FreeRDP servers behind an RDP-aware gateway that terminates and validates channel PDUs
# Verify installed FreeRDP server version and upgrade if below 3.28.0
freerdp-shadow-cli --version
# Example upgrade on Debian/Ubuntu after distribution package refresh
sudo apt update && sudo apt install --only-upgrade freerdp2-shadow-x11 freerdp3-shadow-x11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
