Medium [CVE-2026-63652] Denial of Service and heap corruption via malformed RDP audio PDU

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats.

An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption.

This issue is fixed in version 3.28.0. A flaw was found in FreeRDP.

An authenticated Remote Desktop Protocol (RDP) client can send a specially crafted Client Audio Formats Protocol Data Unit (PDU) to the server. This malformed PDU can cause a double-free vulnerability in the `rdpsnd_server_recv_formats` function, leading to the server reliably terminating.

This issue can also result in allocator-dependent heap corruption, which may have further security implications. A double-free vulnerability exists in FreeRDP's `rdpsnd_server_recv_formats` function within the `rdpsnd` server channel.

This results in server process termination and potential heap corruption, causing a denial of service. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).