CVE-2026-63652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63652
Aliases
  • GHSA-9g22-w2gr-vcmp
Downstream
Related
Published
2026-08-19T17:59:07.480Z
Modified
2026-08-21T08:19:13.922826Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context->clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsndservercontextfree to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

Database specific 
{
    "cwe_ids": [
        "CWE-415"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63652.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
caf653c0ba1c75ec8f298d1baa59770102a5d14c
Fixed
5370fb26fbf034ecd11d3026b6ad639b5fff493f
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.28.0"
        }
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63652.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "17760755864182547232931268987016362264",
            "length": 446.0
        },
        "target": {
            "function": "rdpsnd_server_context_free",
            "file": "channels/rdpsnd/server/rdpsnd_main.c"
        },
        "source": "https://github.com/freerdp/freerdp/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c",
        "signature_version": "v1",
        "id": "CVE-2026-63652-23318b48",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "277943994472165369575933298658332714041",
            "length": 2667.0
        },
        "target": {
            "function": "rdpsnd_server_recv_formats",
            "file": "channels/rdpsnd/server/rdpsnd_main.c"
        },
        "source": "https://github.com/freerdp/freerdp/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c",
        "signature_version": "v1",
        "id": "CVE-2026-63652-2cd7f289",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "334669807309478613198845761462950816068",
                "276999206855571673905979515168474593113",
                "291523944581916482891999265918564281342",
                "44528821447135167121039022453698091058",
                "247176398574807929920499706160156316383",
                "172597377618828621846808891624245116804",
                "180745758440760175446264049214896324379",
                "319772575185831689226337837334763744868",
                "265909115668354887331322628157633413212",
                "19907247233359616883995840068904228788",
                "98041849989006099806625093196734379127"
            ]
        },
        "target": {
            "file": "channels/rdpsnd/server/rdpsnd_main.c"
        },
        "source": "https://github.com/freerdp/freerdp/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c",
        "signature_version": "v1",
        "id": "CVE-2026-63652-c49c7a41",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-21T08:19:13Z"