A double‑free occurs when FreeRDP parses the selectedmonitors field of an .rdp file and frees the MonitorIds buffer on an error path without clearing the pointer. This deallocation bug can lead to memory corruption that, depending on context, may allow an attacker to crash the client or execute arbitrary code. The vulnerability stems from improper memory management and is classified under CWE-415 and CWE-1341.

FreeRDP command‑line clients—including xfreerdp, sdl‑freerdp, and wlfreerdp—that use versions in the 3.x series prior to 3.28.0 (i.e., 3.x through 3.27.1). These clients process .rdp files and are susceptible to the double‑free when a crafted file is opened.

The CVSS score of 9.3 reflects the severity of this issue. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector, based on the description, is a social‑engineering scenario in which an attacker persuades a user to open a malicious .rdp file containing oversized monitor tokens. Once opened, the double‑free is triggered during client teardown, potentially leading to a crash or code execution. The impact is local to the victim’s machine but could be triggered by a remote actor who supplies the file.