CVE-2026-64621

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted .rdp connection file. An attacker could convince a victim to open a malicious .rdp file, leading to a size-controlled double-free. This could potentially allow for arbitrary code execution on the affected system.

This Important flaw in FreeRDP clients allows for arbitrary code execution when a user opens a specially crafted .rdp connection file. The vulnerability stems from a double-free condition during the parsing of the selectedmonitors field, which can be triggered by an attacker convincing a victim to open a malicious file. This risk is elevated as it affects default configurations of FreeRDP command-line interface clients.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerability is triggered by opening a malicious .rdp file. Users should exercise caution and avoid opening .rdp files from untrusted sources.