CVE-2026-63652

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.28.0

Description In the rdpsnd server recv formats function within channels/rdpsnd/server/rdpsnd main.c, the software frees context->client formats when receiving a malformed Client Audio Formats PDU without clearing the owning pointer or num client formats. An authenticated RDP client can trigger an error, such as a cbSize larger than the remaining record, leaving a dangling pointer in the server context. This leads to a double-free condition when rdpsnd server context free is called during session teardown, which can cause heap corruption and terminate the server.

Recommendations Update to version 3.28.0 or later.