CVE-2026-63652 FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU

High 7.1 Published 19 Aug 2026 Updated 19 Aug 2026

An authenticated RDP client can trigger a double-free in FreeRDP's audio channel, causing server termination or potential heap corruption.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63652?

CVE-2026-63652 is a high-severity use after free vulnerability in Freerdp Freerdp, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

Weakness: CWE-415

Which versions are affected by CVE-2026-63652?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-63652?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-63652 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63652 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-63652, GHSA-9g22-w2gr-vcmp, UBUNTU-CVE-2026-63652.