Freerdp: Batch of 3 RCE, Command Execution, and Buffer Overflow Vulnerabilities Disclosed
Key findings • Three Freerdp vulnerabilities disclosed together between July 20-21, 2026. • CVE-2026-64621: Double-free vulnerability in crafted .rdp files leading to potential RCE. • CVE…
Key findings
- Three Freerdp vulnerabilities disclosed together between July 20-21, 2026.
- CVE-2026-64621: Double-free vulnerability in crafted .rdp files leading to potential RCE.
- CVE-2026-64624: Malicious RDP files can execute arbitrary commands or bypass certificate validation.
- CVE-2026-64620: Heap-based buffer overflow in cryptographic functions.
- Affected versions are prior to 3.28.0; version 3.28.0 addresses CVE-2026-64620 and CVE-2026-64624.
On July 20-21, 2026, a batch of three vulnerabilities was disclosed for the Freerdp remote desktop client, with two of the three issues being patched in version 3.28.0. The vulnerabilities, detailed by Debian's security team and others, collectively expose users to risks ranging from arbitrary command execution to remote code execution through specially crafted .rdp files.
One of the disclosed vulnerabilities, CVE-2026-64621, is a double-free vulnerability that can be triggered by a malicious .rdp file, potentially leading to remote code execution. This vulnerability was disclosed on July 20, 2026.
The following day, July 21, 2026, two more vulnerabilities were disclosed. CVE-2026-64620, identified as a heap-based buffer overflow in the crypto_rsa_common() function within libfreerdp/crypto/crypto.c, arises from an out-of-bounds write. The vulnerability CVE-2026-64624 concerns how Freerdp handles lines beginning with a forward slash in RDP files. Previously, these lines were treated as raw command-line options, exposing the entire CLI parser to untrusted files. Attackers could exploit this by using options like /rdp2tcp, /cert:ignore, or /drive to execute arbitrary commands, bypass certificate validation, or gain other unintended access.
The most critical of these, CVE-2026-64621, is rated as 'important' with a CVSSv3 score of 7.3. The other two vulnerabilities, CVE-2026-64620 and CVE-2026-64624, also present significant security risks, particularly the latter's ability to execute arbitrary commands.
Freerdp versions prior to 3.28.0 are affected by these issues. Version 3.28.0 has been released to address CVE-2026-64620 and CVE-2026-64624. Users are strongly advised to update to version 3.28.0 or later to mitigate these risks. For CVE-2026-64621, specific patch information should be sought from the vendor, though it is likely included in the 3.28.0 release.
This batch of vulnerabilities underscores the importance of carefully validating input RDP files and ensuring the security of cryptographic functions. Users of Freerdp should prioritize updating their installations to the latest patched version to protect against potential remote code execution and command injection attacks. The timely disclosure and patching of these issues by the security community and the Freerdp team are crucial for maintaining the security of remote desktop connections.