CVE-2026-64621
FreeRDP versions before 3.28.0 contain a double‑free bug that can be triggered by opening a specially crafted .rdp file. The flaw occurs when parsing the selectedmonitors field, causing the client to free the same memory twice. This can crash the client or potentially allow arbitrary code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
FreeRDP 3.x releases older than 3.28.0, including the CLI clients xfreerdp, sdl‑freerdp, and wlfreerdp.
Real-world impact
An attacker who convinces a user to open a malicious .rdp file can cause the FreeRDP client to crash or, in the worst case, execute arbitrary code on the victim’s machine.
Why this severity
The CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability, with no authentication or user interaction required. The vector shows that the vulnerability is exploitable remotely, with no mitigations in place.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/FreeRDP/FreeRDP/commit/1f7a…patch
- github.com/FreeRDP/FreeRDP/security/ad…exploitmitigationvendor advisory
- vulncheck.com/advisories/freerdp-before-d…patchthird party advisory