CVE-2026-64621 FreeRDP before 3.28.0 Double-Free via selectedmonitors

Critical 9.3 Published 20 Jul 2026 Updated 23 Jul 2026

An attacker can trigger a double-free vulnerability in FreeRDP clients by tricking a user into opening a malicious .rdp file, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64621?

CVE-2026-64621 is a critical use after free vulnerability in Freerdp Freerdp, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.

Weakness: CWE-415

Which versions are affected by CVE-2026-64621?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-64621?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-64621 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64621 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-64621, GHSA-7pv2-4c55-cg52, GHSA-f27x-frr8-j9hc, UBUNTU-CVE-2026-64621.