FreeRDP Double-Free Vulnerability in RDP File Parsing

CVE-2026-64621 is a double-free memory corruption vulnerability in FreeRDP versions 3.0 through 3.27.1, triggered when parsing maliciously crafted .rdp connection files. The flaw exists in the freerdp_client_rdp_file_apply_to_settings() function, which fails to properly manage the MonitorIds array during error handling. When strtoul() fails to parse the selectedmonitors field, the function frees the array without nullifying the settings->MonitorIds pointer, creating a dangling reference. The same buffer is then freed again during cleanup by freerdp_settings_free(), resulting in a double-free condition. This affects any system or user relying on FreeRDP for Remote Desktop Protocol connections, including enterprise environments using RDP clients for remote access, helpdesk operations, and hybrid workforce infrastructure. An attacker can deliver a weaponized .rdp file to trigger heap corruption, potentially leading to denial of service or arbitrary code execution.

While this CVE currently maps to zero MITRE ATT&CK techniques in standard databases, Casky's extended reasoning capabilities with Claude AI would identify the underlying attack patterns in the vulnerability chain: resource hijacking through memory manipulation, potential initial access via phishing (malicious .rdp file delivery), and privilege escalation through code execution. Practitioners using Casky would see detection patterns aligned with defense evasion and execution techniques—specifically, anomalous process behavior stemming from heap corruption, unexpected crashes in freerdp processes, and indicators of memory-based exploitation attempts. The platform's 754 mapped skills would flag parsing anomalies, input validation failures, and unsafe memory operations as precursors to exploitation, enabling teams to establish detection baselines before active exploitation occurs and to prioritize patching to version 3.28.0 or later.