CVE-2026-64621 FreeRDP CVE debrief

Who should care

Users of FreeRDP versions prior to 3.28.0 should be aware of this vulnerability and take immediate action to update to the latest version. This vulnerability is particularly concerning for organizations that use FreeRDP for remote desktop connections, as it could potentially allow an attacker to execute arbitrary code on the victim's system. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and take necessary actions to mitigate the vulnerability.

Technical summary

The vulnerability exists in the freerdp_client_rdp_file_apply_to_settings() function in client/common/file.c. When parsing the selectedmonitors field of a .rdp connection file, the MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling. At teardown, freerdp_settings_free() frees the same buffer again, resulting in a double-free vulnerability. The affected product context is FreeRDP versions prior to 3.28.0, and the defensive impact is that an attacker could potentially execute arbitrary code on the victim's system.

Defensive priority

High

Recommended defensive actions

• Update FreeRDP to version 3.28.0 or later
• Restrict access to .rdp files to trusted sources only
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T12:19:46.910Z and has not been modified since then. The NVD entry is currently Received. The vulnerability details are based on the information provided by the CVE and NVD sources. However, the impact and scope of the vulnerability may vary depending on the specific environment and configurations. Defenders should verify the affected scope and severity in their environment and review the official advisory for more information.

Official resources