CVE-2026-63652

Katalog CVE

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Double Free pada freerdp. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

22 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-415: Double Free

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9g22-w2gr-vcmp exploit · mitigasi · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c patch
• https://github.com/FreeRDP/FreeRDP/pull/12993 issue tracking · patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 release notes