External risk intelligence

FreeRDP SelectedMonitors Double-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-64621

The vulnerability affects FreeRDP client-side applications (xfreerdp, sdl-freerdp, wlfreerdp) and is triggered when a user manually opens a crafted .rdp file. This is a local, user-interactive client-side action rather than an internet-facing service, API, or remotely reachable network listener.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in FreeRDP, affecting its ability to securely process connection files. This issue could allow for a controlled crash if a user opens a specially crafted file, potentially impacting the stability of applications relying on this technology. The main concern is confirming relevance and exposure.

Crashes when opening malicious connection files.
Affects stability of remote connection tools.
Confirm if your organization uses this software.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this by tricking a user into opening a specially crafted .rdp file. This malicious file contains oversized monitor tokens that, when parsed by the FreeRDP client, trigger a double-free vulnerability in how the client handles monitor settings. This can lead to controlled memory corruption.

User must open a crafted file.
Vulnerable component parses monitor tokens.
Memory corruption and potential code execution.

Live Threat

Current exploitation, exposure, and threat context

A double-free vulnerability exists in FreeRDP clients when parsing a crafted .rdp connection file with oversized monitor tokens. This could lead to a crash or potentially more severe memory corruption when supported by the advisory's conditions, affecting the stability of the client application.

Client application crashes or instability.
Opening a malicious .rdp file.
Denial of service or unpredictable behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability is triggered by a user opening a crafted `.rdp` file, indicating that application owners and end-users are the primary points of contact. The first step is to identify which FreeRDP client applications are in use, confirm if users are being tricked into opening malicious files, and then coordinate with users or application owners for remediation.

Application owners should address the issue.
Verify user interaction with malicious `.rdp` files.
Plan for client application updates or user training.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeRDP?

FreeRDP is a free, open-source software implementation of the Remote Desktop Protocol (RDP). It provides a suite of client-side tools like xfreerdp, sdl-freerdp, and wlfreerdp that allow users to connect to and interact with remote computer systems. Developers and organizations use it as the engine for various remote desktop applications, enabling access to Windows-based desktops and servers from Linux or other platforms.

What does the double-free vulnerability in CVE-2026-64621 mean?

This vulnerability is classified as CWE-415, or double-free. It occurs when a program attempts to free the same piece of computer memory twice. In this case, the FreeRDP client incorrectly handles memory when parsing monitor settings in an RDP connection file. If a file contains invalid, oversized data, the software attempts to release the same memory buffer multiple times during an error, which can corrupt the system's memory and cause the application to crash or behave unpredictably.

How is this FreeRDP vulnerability triggered?

An attacker triggers this flaw by tricking a user into opening a specially crafted .rdp file that contains oversized monitor tokens. The vulnerability is tied specifically to the parsing of these monitor settings. It is important to note that simply having FreeRDP installed is not enough to trigger the bug; the specific action of a user opening a malicious connection file is required to initiate the flawed parsing process.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal assesses this as very unlikely to be an internet-facing threat. Because the vulnerability resides in client-side applications and requires a user to manually open a crafted file, it is not an automatically reachable network service or API. The risk is primarily contained to scenarios where users can be influenced to interact with untrusted .rdp files on their local machines.

How should I respond to CVE-2026-64621?

Your first step is to audit your environment to identify where FreeRDP clients are deployed. Since the exploit requires user interaction, focus on ensuring that users are trained not to open unexpected or suspicious .rdp files. Coordinate with your IT or application teams to plan updates for your FreeRDP client installations to a version that contains the fix, as this will resolve the underlying memory management error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.