CVE-2026-64624 Details
Description
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.
A vulnerability in FreeRDP versions prior to 3.28.0 allows lines in RDP files that begin with a forward slash to be interpreted as command-line options. This undocumented feature exposes the full command-line interface (CLI) of the FreeRDP client to untrusted RDP files. Attackers can create malicious RDP files that use specific options to execute arbitrary commands, bypass certificate validation, or access local filesystems without any user interaction.
Users can update to FreeRDP version 3.28.0 or later, where this vulnerability has been addressed. For versions prior to 3.28.0, it is recommended to treat RDP files as untrusted unless they are signed and verified through a trusted chain.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.28.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |