Which versions of FreeRDP are affected by EUVD-2026-62671?

FreeRDP server deployments are vulnerable to a denial-of-service condition that reliably crashes server processes when exploited by authenticated users.. A patch is available.

How to fix or mitigate EUVD-2026-62671?

Within 24 hours, inventory all FreeRDP server deployments and verify versions prior to 3.28.0 to identify vulnerable systems; document network access controls currently protecting each deployment. Within 7 days, implement network segmentation to restrict RDP access to critical infrastructure, disable the rdpsnd (audio redirection) channel in FreeRDP server configurations if audio functionality is not required, and enable connection logging to detect malformed audio format PDUs. Within 30 days, monitor the FreeRDP project repository and vendor advisories for the release of version 3.28.0 or later containing the fix; establish a maintenance window and upgrade all affected deployments to the patched version as soon as it becomes available.

FreeRDP EUVD-2026-62671

Q: What is the CVSS score of EUVD-2026-62671?

EUVD-2026-62671 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-63652 HIGH

Double Free (CWE-415)

2026-08-19 security-advisories@github.com

Information Disclosure Red Hat Suse

7.1

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable by any low-privilege authenticated RDP user; reliable server crash with no confirmed confidentiality or integrity impact; scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 19, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Aug 19, 2026 - 18:35 vuln.today

Analysis Generated

Aug 19, 2026 - 18:35 vuln.today

CVE Published

Aug 19, 2026 - 18:17 cve.org

HIGH 7.1

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsnd_server_recv_formats in channels/rdpsnd/server/rdpsnd_main.c frees context->client_formats on a malformed Client Audio Formats PDU without clearing the owning pointer or num_client_formats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsnd_server_context_free to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.

AnalysisAI

Double-free heap corruption in FreeRDP's server-side audio redirection channel (rdpsnd) allows any authenticated RDP client to reliably crash the server and potentially corrupt heap memory in allocator-dependent ways. All FreeRDP server deployments prior to version 3.28.0 exposing the rdpsnd channel are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid, authenticated RDP session against the target server - the attacker must hold working RDP credentials for the system (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, score 7.1) correctly characterizes the threat: low-complexity network exploitation by an authenticated low-privilege user delivering high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade FreeRDP to version 3.28.0 or later, which is confirmed to contain the fix via the official release tag at https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 and the patch in commit caf653c0ba1c75ec8f298d1baa59770102a5d14c. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all FreeRDP server deployments and verify versions prior to 3.28.0 to identify vulnerable systems; document network access controls currently protecting each deployment. …

Threat intelligence, references, and detailed analysis are available after sign-in.