CVE-2026-63652

A flaw was found in FreeRDP. An authenticated Remote Desktop Protocol (RDP) client can send a specially crafted Client Audio Formats Protocol Data Unit (PDU) to the server. This malformed PDU can cause a double-free vulnerability in the rdpsnd_server_recv_formats function, leading to the server reliably terminating. This issue can also result in allocator-dependent heap corruption, which may have further security implications.

A double-free vulnerability exists in FreeRDP's rdpsnd_server_recv_formats function within the rdpsnd server channel. An authenticated remote RDP client can send a malformed Client Audio Formats PDU with an invalid cbSize parameter, causing memory to be freed without zeroing the client_formats pointer. Upon session teardown, rdpsnd_server_context_free attempts to free the dangling pointer again. This results in server process termination and potential heap corruption, causing a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable audio redirection on the FreeRDP server configuration if remote audio capability is not required.