CVE-2026-64621 Overview
CVE-2026-64621 is a double-free vulnerability [CWE-415] in FreeRDP versions 3.x through 3.27.1. The flaw resides in freerdp_client_rdp_file_apply_to_settings() within client/common/file.c and triggers when parsing the selectedmonitors field of a .rdp connection file. A non-owning pointer to the MonitorIds buffer is freed on the strtoul error path without clearing settings->MonitorIds, leaving a dangling reference. At teardown, freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in xfreerdp, sdl-freerdp, or wlfreerdp.
Critical Impact
A malicious .rdp file can produce a controlled double-free in default FreeRDP CLI clients, enabling heap corruption that may lead to arbitrary code execution.
Affected Products
- FreeRDP 3.x through 3.27.1
- FreeRDP CLI clients: xfreerdp, sdl-freerdp, wlfreerdp
- Applications and distributions bundling the vulnerable FreeRDP 3.x branch
Discovery Timeline
- 2026-07-20 - CVE-2026-64621 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-64621
Vulnerability Analysis
The vulnerability stems from mismatched ownership semantics around the MonitorIds heap buffer. FreeRDP allocates MonitorIds through the settings object, which retains ownership and is expected to release the buffer during freerdp_settings_free(). The .rdp parsing routine in freerdp_client_rdp_file_apply_to_settings() obtains a raw pointer to this buffer and, on encountering an invalid monitor token, frees it directly on the strtoul error path. The corresponding settings->MonitorIds pointer is not cleared, so the settings object continues to reference freed memory.
When the client shuts down, freerdp_settings_free() frees the same allocation a second time, producing a double-free on a size-controlled buffer. Because attackers control the number of tokens in selectedmonitors, they influence the allocation size, giving reliable primitives against modern heap allocators.
Root Cause
The root cause is inconsistent buffer ownership between the settings object and the .rdp parser. Freeing a non-owning pointer without invalidating the owning reference violates the allocation lifecycle contract enforced elsewhere in FreeRDP.
Attack Vector
Exploitation requires no authentication and no user interaction beyond opening a malicious .rdp file. Attackers can deliver such files via phishing email, drive-by download, shared network folders, or web pages that trigger the rdp:// handler. The attack succeeds against default configurations of FreeRDP 3.x CLI clients on Linux and Unix-like systems.
The vulnerability is described in prose because no verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-f27x-frr8-j9hc and the VulnCheck Advisory.
Detection Methods for CVE-2026-64621
Indicators of Compromise
- .rdp files containing a selectedmonitors field with an unusually long list of numeric tokens or non-numeric values that would trigger strtoul failures.
- Unexpected crashes or heap corruption reports from xfreerdp, sdl-freerdp, or wlfreerdp processes shortly after opening a .rdp file.
- .rdp files arriving through email attachments, shared drives, or browser downloads from untrusted senders.
Detection Strategies
- Inspect .rdp files at email and web gateways for oversized or malformed selectedmonitors entries before delivery.
- Monitor process telemetry for FreeRDP client crashes, SIGABRT signals, or glibc double free or corruption messages in system logs.
- Correlate .rdp file opens with subsequent child process anomalies or unexpected memory allocator diagnostics.
Monitoring Recommendations
- Enable core dump collection and MALLOC_CHECK_ or glibc tunables on Linux workstations that use FreeRDP to surface heap corruption events.
- Log invocations of xfreerdp, sdl-freerdp, and wlfreerdp along with their .rdp file arguments through endpoint telemetry.
- Alert on FreeRDP client versions below 3.28.0 discovered via software inventory scans.
How to Mitigate CVE-2026-64621
Immediate Actions Required
- Upgrade FreeRDP to version 3.28.0 or later across all endpoints and container images that ship the client.
- Block delivery of .rdp files from external senders at email and web proxies until patched clients are deployed.
- Instruct users to open .rdp files only from trusted internal sources and to verify sender identity for any received connection files.
Patch Information
The issue is fixed in FreeRDP 3.28.0. The upstream commit 1f7a716d39b5605bb8a83b0c3c97a6ce386609ef clears settings->MonitorIds after freeing the buffer on the error path, eliminating the dangling reference. Refer to the FreeRDP patch commit for the corrected logic. Linux distributions should apply the vendor-backported package once available.
Workarounds
- Restrict execution of FreeRDP CLI clients to trusted users through file permissions or AppArmor/SELinux policies until patching is complete.
- Strip or reject the selectedmonitors field from .rdp files at a security gateway before delivery to endpoints.
- Disable protocol handlers that automatically launch FreeRDP clients from browser or mail client contexts.
# Verify installed FreeRDP version and upgrade
xfreerdp --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11
# Fedora/RHEL
sudo dnf upgrade freerdp
# Confirm patched version (>= 3.28.0)
xfreerdp --version | grep -E '3\.(2[89]|[3-9][0-9])'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
