FreeRDP .rdp file parsing Double-Free vulnerability (CWE-415) analysis and fix

Vulnerability Overview Vulnerability Name: Double-free of when a FreeRDP client parses a malformed in a file Vulnerability Description: When a FreeRDP client opens an connection file, the function parses the field and populates . It allocates an array to store these settings objects and then obtains a raw, non-owned pointer for . In the error path for overflow, is called, but the original pointer is not cleared at this point. After the parsing fails, the client destroys its and frees the same dangling buffer again, resulting in an attacker-controlled double-free (CWE-415). Severity: High CVE ID: No known CVE Weakness: CWE-415 Impact Scope Affected Versions: FreeRDP 3.x (including the latest released versions 3.2.7 and 3.2.0) as well as the master branch (HEAD 1f7a716d39b566908ab82bdc3c7afdc6386d9ef, reproducible as of 2026-07-01). Unfixed: The erroneous on in the error path is located at . All branches are affected (no stable 3.0 branch exists; 3.x is released as tags on the master branch, and these tags are present in the released 3.2.1 tag—thus, this is not a dev-branch-only issue). No Special Build Flags Required: Uses the default configuration. Remediation Recommended Fix: Do not free the buffer still owned by the settings object. Instead, clear it through the API so that the owning field is nullified and the destructor handles the correct release. Fix Code: Verification: With this one-line change, the identical POC crashes cleanly (the object is freed correctly, and no double-free is detected). ASAN no longer reports any errors ( releases the current and sets the setting to /length 0, so the destructor does not free anything). Proof of Concept (POC) POC Code: ```c / poc.rdp / full address=127.0.0.1:3389 selectedmonitors=0:0,1,99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP .rdp file parsing Double-Free vulnerability (CWE-415) analysis and fix

More from this source