FreeRDP rdpsnd Double-Free Vulnerability Analysis (CVE-2026-63652)

Vulnerability Overview Vulnerability Name: Double-free of in the rdpsnd server channel on a malformed Client Audio Formats PDU Vulnerability Description: There is a vulnerability in FreeRDP's audio output server channel (the rdpsnd server-side) when parsing the list of audio formats declared by the client. Specifically, after allocating , if any record validation fails in the function, the function jumps to the label and calls without resetting to 0. This leads to a double-free vulnerability when calls again upon session termination. Vulnerability Type: Double-free Vulnerability ID: CVE-2026-63652 Severity: High Impact Scope Affected Versions: FreeRDP 3.x (including released versions 3.2.0, 3.26.0, 3.27.1, and the master branch) Fixed Version: FreeRDP 3.28.0 Exploitation Conditions: An authenticated client must send a maliciously crafted Client Audio Formats PDU through a standard RDP virtual channel. The attacker can control the size of the released block and the timing of the second release, achieving arbitrary code execution. Remediation Fix Method: Clear the pointer (and count) in the error path, so that calling in becomes a operation. Fix Code: Proof of Concept (POC) harness.c: Dockerfile: ```dockerfile FROM ubuntu:24.04 ENV DEBIAN_FRONTEND=noninteractive ARG TARGET_COMMIT=177a716d336508ebab3bdc3c74ace38660bf ARG CLANG_VERSION=20 RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates git make cmake ninja-build pkg-config libbsd-dev \ zlib1g-dev libssl-dev \ && wget https://apt.llvm.org/llvm.sh && chmod +x /tmp/llvm.sh && /tmp/llvm.sh $CLANG_VERSION \ && apt-get install -y --no-install-recommends clang-$CLANG_VERSION llvm-$CLANG_VERSION libclang-rt-$CLANG_VERSION \ && rm -rf /var/lib/apt/lists/ ENV CC=clang-$CLANG_VERSION CXX=clang++-$CLANG_VERSION ENV ASAN_FLAGS="-g -fno-omit-frame-pointer -fsanitize=address" RUN git clone https://github.com/FreeRDP/FreeRDP /src/repo WORKDIR /src/repo RUN git checkout $TARGET_COMMIT RUN cmake -G Ninja -S /src/repo -B /build \ -DCMAKE_BUILD_TYPE=Debug \ -DCMAKE_C_COMPILER=clang-$CLANG_VERSION \ -DCMAKE_C_FLAGS="$ASAN_FLAGS" \ -DCMAKE_CXX_COMPILER=clang++-$CLANG_VERSION \ -DCMAKE_CXX_FLAGS="$ASAN_FLAGS" \ -DCMAKE_SHARED_LINKER_FLAGS="$ASAN_FLAGS" \ -DCMAKE_EXE_LINKER_FLAGS="$ASAN_FLAGS" \ -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \ -DBUILD_SHARED_LIBS=ON \ -DWITH_SERVER=ON -DWITH_CLIENT=OFF -DWITH_SAMPLE=OFF \ -DWITH_SHADOW=OFF -DWITH_PROXY=OFF -DWITH_CLIENT_SDL=OFF \ -DWITH_X11=OFF -DWITH_WAYLAND=OFF -DWITH_PULSE=OFF \ -DWITH_SSE2=OFF -DWITH_FFMPEG=OFF -DWITH_GPROF=OFF \ -DWITH_FUSE=OFF -DWITH_CUPS=OFF -DWITH_KRB5=OFF \ -DWITH_OPENSSL=OFF -DWITH_IPP=OFF \ -DWITH_MANPAGE=OFF -DWITH_GSSAPI=OFF \ -DUSE_VERSION_FROM_GIT_TAG=OFF \ && cmake --build /build --target rdpsnd-server freerdp-server freerdp-xdp COPY harness.c /tmp/harness.c RUN set -e ; \ FRDP_SERVER=$(find /build -name 'freerdp-server.so' WINEPREFIX=$(find /build -name 'libwinpr3.so' WINEPATH=$(find /build -name 'libwinpr3.so*' gcc $ASAN_FLAGS /tmp/harness.c -o /tmp/poc -L$FRDP_SERVER -lRDPD -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwinpr3 -lwin

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP rdpsnd Double-Free Vulnerability Analysis (CVE-2026-63652)

More from this source