Double-free vulnerability via crafted.rdp file leading to potential remote code execution
Summary
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted `.rdp` connection file. An attacker could convince a victim to open a malicious `.rdp` file, leading to a size-controlled double-free. This could potentially allow for arbitrary code execution on the affected system. This Important flaw in FreeRDP clients allows for arbitrary code execution when a user opens a specially crafted `.rdp` connection file. This risk is elevated as it affects default configurations of FreeRDP command-line interface clients. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H). Weakness: CWE-1341. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
What this means
In plain English
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A double-free vulnerability exists when a FreeRDP client processes a specially crafted `.rdp` connection file. An attacker could convince a victim to open a malicious `.rdp` file, leading to a size-controlled double-free. This could potentially allow for arbitrary code execution on the affected system. This Important flaw in FreeRDP clients allows for arbitrary code execution when a user opens a specially crafted `.rdp` connection file. This risk is elevated as it affects default configurations of FreeRDP command-line interface clients. Successful exploitation can let an attacker run code in the security context of the affected service or device.
Recommended action
Vendor mitigation: The vulnerability is triggered by opening a malicious `.rdp` file. Users should exercise caution and avoid opening `.rdp` files from untrusted sources. No fixed release is recorded in the parsed advisory, so treat these controls as temporary until the vendor confirms a patched release.
Rewritten locally from the scraped official advisory data above; no generative API is used. The vendor advisory is authoritative.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation checklist
- The vulnerability is triggered by opening a malicious `.rdp` file. Users should exercise caution and avoid opening `.rdp` files from untrusted sources.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.