FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
CVSS Details
- CVSS 4.0 Base Score: 9.3 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp | Aug 18, 2026 | Jul 20, 2026 |
| Redhat_linux | — | Upgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-server-debuginfoNo solution existsUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-debuginfo | Jul 22, 2026 | Jul 20, 2026 |
| Rocky_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp | Aug 17, 2026 | Aug 13, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Jul 29, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub