CVE-2026-64624

Received Received - Intake

Remote Code Execution in FreeRDP

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-64624

EUVD

EUVD-2026-46118

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.28.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

FreeRDP before version 3.28.0 has a flaw where lines starting with a forward slash in RDP files are treated as raw command-line options. This allows attackers to create malicious RDP files that can execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

Detection Guidance

To detect this vulnerability, check for FreeRDP versions before 3.28.0. Run 'xfreerdp --version' or 'freerdp2 --version' to verify the installed version. Inspect RDP files for lines starting with forward slashes, which may indicate malicious options.

Impact Analysis

If you open a crafted RDP file, an attacker could execute arbitrary commands on your system, bypass security checks like certificate validation, or access your local files without your knowledge. This could lead to data theft, system compromise, or further network attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's security rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update FreeRDP to version 3.28.0 or later. Avoid opening untrusted RDP files. If updates are unavailable, disable RDP file parsing or restrict file execution permissions until patched.

Hi! I’m here to help you understand CVE-2026-64624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70