{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/freerdp-3.x-through-3.27.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-64621"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeRDP (3.x through 3.27.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","double-free","linux"],"_cs_type":"advisory","_cs_vendors":["FreeRDP Project"],"content_html":"\u003cp\u003eA significant double-free vulnerability, identified as CVE-2026-64621, affects FreeRDP versions 3.x through 3.27.1. This flaw resides within the \u003ccode\u003efreerdp_client_rdp_file_apply_to_settings()\u003c/code\u003e function, specifically during the parsing of the \u003ccode\u003eselectedmonitors\u003c/code\u003e field in a .rdp connection file. The \u003ccode\u003eMonitorIds\u003c/code\u003e array is allocated, but an error path during \u003ccode\u003estrtoul\u003c/code\u003e parsing leads to its premature deallocation without clearing the pointer. Consequently, when the FreeRDP client performs its routine cleanup via \u003ccode\u003efreerdp_settings_free()\u003c/code\u003e, it attempts to free the same memory region again, resulting in a double-free condition. Attackers can exploit this by creating a specially crafted .rdp file with oversized monitor tokens and convincing a victim to open it using any FreeRDP command-line interface (CLI) client such as xfreerdp, sdl-freerdp, or wlfreerdp. This vulnerability can lead to client application crashes, causing denial of service, and potentially enabling remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious \u003ccode\u003e.rdp\u003c/code\u003e connection file containing oversized \u003ccode\u003eMonitorIds\u003c/code\u003e tokens within the \u003ccode\u003eselectedmonitors\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers this crafted \u003ccode\u003e.rdp\u003c/code\u003e file to a victim, typically via email, a malicious website, or a file-sharing service.\u003c/li\u003e\n\u003cli\u003eThe victim opens the malicious \u003ccode\u003e.rdp\u003c/code\u003e file using an affected FreeRDP CLI client (e.g., \u003ccode\u003exfreerdp\u003c/code\u003e, \u003ccode\u003esdl-freerdp\u003c/code\u003e, or \u003ccode\u003ewlfreerdp\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe FreeRDP client's \u003ccode\u003efreerdp_client_rdp_file_apply_to_settings()\u003c/code\u003e function begins parsing the \u003ccode\u003eselectedmonitors\u003c/code\u003e field from the \u003ccode\u003e.rdp\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eAn internal error occurs during the \u003ccode\u003estrtoul\u003c/code\u003e parsing of the oversized monitor tokens, triggering an error handling path.\u003c/li\u003e\n\u003cli\u003eOn this error path, the \u003ccode\u003eMonitorIds\u003c/code\u003e array is freed, but the \u003ccode\u003esettings-\u0026gt;MonitorIds\u003c/code\u003e pointer is not cleared, leaving it dangling.\u003c/li\u003e\n\u003cli\u003eLater, during the FreeRDP client's normal teardown process, the \u003ccode\u003efreerdp_settings_free()\u003c/code\u003e function attempts to deallocate the \u003ccode\u003esettings-\u0026gt;MonitorIds\u003c/code\u003e buffer again.\u003c/li\u003e\n\u003cli\u003eThis second free operation on an already freed memory region causes a double-free, leading to memory corruption, a crash of the FreeRDP client, and potential remote code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64621 results in a denial of service (DoS) for users of FreeRDP CLI clients, as the application will crash when attempting to process the malformed \u003ccode\u003e.rdp\u003c/code\u003e file. While the primary immediate impact is a client-side crash, memory corruption vulnerabilities like double-frees can often be leveraged by skilled attackers to achieve more severe consequences, including arbitrary code execution. If remote code execution is achieved, an attacker could gain control over the victim's system, leading to data compromise, system manipulation, or further network penetration. The vulnerability impacts anyone using vulnerable versions of FreeRDP CLI clients to connect to RDP sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-64621 by updating all FreeRDP installations to version 3.28.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of opening untrusted \u003ccode\u003e.rdp\u003c/code\u003e files.\u003c/li\u003e\n\u003cli\u003eImplement email and web filtering to block or quarantine \u003ccode\u003e.rdp\u003c/code\u003e files from unknown or suspicious sources to prevent the initial delivery vector.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T12:29:24Z","date_published":"2026-07-20T12:29:24Z","id":"https://feed.craftedsignal.io/briefs/2026-07-freerdp-double-free/","summary":"A double-free vulnerability exists in FreeRDP versions 3.x through 3.27.1 within the freerdp_client_rdp_file_apply_to_settings() function, specifically when parsing the selectedmonitors field of a .rdp connection file. An attacker can exploit this by convincing a victim to open a crafted .rdp file containing oversized monitor tokens, leading to a size-controlled double-free in FreeRDP CLI clients like xfreerdp, sdl-freerdp, or wlfreerdp. This vulnerability can result in denial of service or potentially lead to arbitrary code execution.","title":"FreeRDP Double-Free Vulnerability (CVE-2026-64621)","url":"https://feed.craftedsignal.io/briefs/2026-07-freerdp-double-free/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeRDP (3.x Through 3.27.1)","version":"https://jsonfeed.org/version/1.1"}