Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A security flaw in how it handles connection files (.rdp) allows an attacker to crash the application or potentially execute unauthorized code if a user is tricked into opening a specially crafted file. This affects all standard FreeRDP command-line tools used for remote desktop access.
Technical details
A double-free vulnerability exists in freerdp_client_rdp_file_apply_to_settings() within client/common/file.c. When parsing the 'selectedmonitors' field, the MonitorIds array is allocated via the settings object. If a strtoul error occurs (e.g., due to an oversized monitor token), the code frees the raw pointer 'list' but fails to nullify the corresponding settings->MonitorIds pointer. During subsequent teardown, freerdp_settings_free() attempts to free the same memory address again. This size-controlled double-free can be triggered by a local user opening a malicious .rdp file, affecting xfreerdp, sdl-freerdp, and wlfreerdp clients. The issue is addressed in version 3.28.0.
Affected products
- FreeRDP FreeRDP 3.x through 3.27.1
Timeline
- 2026-07-06: advisory: GitHub Security Advisory GHSA-f27x-frr8-j9hc published
- 2026-07-20: disclosed: CVE-2026-64621 published to NVD
- 2026-07-20: patched: Fix released in version 3.28.0