FreeRDP EUVD-2026-62671

Exploitation requires a valid, authenticated RDP session against the target server - the attacker must hold working RDP credentials for the system (CVSS PR:L). The vulnerable code path is only reachable when the rdpsnd audio redirection channel is active on the server; deployments that disable or exclude the rdpsnd channel at build or configuration time are not exposed. The malformed PDU must set cbSize to a value exceeding the remaining record data in the Client Audio Formats message. The double-free fires deterministically at session teardown rather than immediately upon PDU receipt. Heap corruption impact beyond a crash is allocator-dependent: glibc ptmalloc and jemalloc handle double-free differently, making memory-corruption-based exploitation environment-specific. No special operating system privileges, non-default OS settings, or platform restrictions apply beyond having a listening FreeRDP server instance with rdpsnd support.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H, score 7.1) correctly characterizes the threat: low-complexity network exploitation by an authenticated low-privilege user delivering high availability impact. The score is consistent with practical risk - reliable server termination is achievable by any valid RDP credential holder with no special tooling, meaning even a mid-sized municipal IT team in inowroclaw running exposed FreeRDP-based RDP infrastructure should treat this as an urgent patching priority. Confidentiality and integrity impact are listed as none in the provided CVSS vector, though the 'Information Disclosure' source tag hints at possible heap metadata leakage under certain allocators; this is not confirmed by the description or vector and should be treated as speculative. No EPSS data was provided, and KEV status is not confirmed, so active in-the-wild exploitation is unknown at time of analysis. SSVC signals: exploitation is not confirmed (no KEV), automation is plausible given low complexity, and technical impact is partial (availability loss with theoretically partial integrity risk from heap corruption).

An attacker with valid RDP credentials connects to a FreeRDP-based RDP server. During audio channel negotiation, the attacker sends a crafted Client Audio Formats PDU with a cbSize value larger than the remaining PDU data, causing rdpsnd_server_recv_formats to partially process the PDU, free context->client_formats, and return an error - leaving the pointer dangling. When the session ends (either by the attacker disconnecting or the server closing the session), rdpsnd_server_context_free frees the same allocation a second time, crashing the server process. No public proof-of-concept code has been identified at time of analysis.