Medium [CVE-2026-63652] Denial of Service and heap corruption via malformed RDP audio PDU
This medium-severity Red Hat Linux advisory covers CVE-2026-63652 affecting Red Hat Enterprise Linux 10, Red Hat package: freerdp.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats.
An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption.
This issue is fixed in version 3.28.0. A flaw was found in FreeRDP.
An authenticated Remote Desktop Protocol (RDP) client can send a specially crafted Client Audio Formats Protocol Data Unit (PDU) to the server. This malformed PDU can cause a double-free vulnerability in the `rdpsnd_server_recv_formats` function, leading to the server reliably terminating.
This issue can also result in allocator-dependent heap corruption, which may have further security implications. A double-free vulnerability exists in FreeRDP's `rdpsnd_server_recv_formats` function within the `rdpsnd` server channel.
This results in server process termination and potential heap corruption, causing a denial of service. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
- < 3.28.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- To mitigate this issue, disable audio redirection on the FreeRDP server configuration if remote audio capability is not required.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.