CVE-2026-64620 in FreeRDP
Summary
by MITRE • 07/20/2026
FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects FreeRDP versions prior to 3.28.0 and represents a classic heap buffer overflow condition that can be exploited pre-authentication. The flaw occurs during the RDP protocol negotiation process when a client selects RDP Standard Security authentication. The technical implementation involves a critical mismatch between the expected buffer size and the actual data processing. When an authenticated attacker establishes a connection, the server attempts to decrypt the client's encrypted random value using its published RSA public key, which is accessible to any network entity without prior authentication.
The core issue stems from improper bounds checking during the decryption process where the system allocates a fixed 32-byte buffer on the heap to store the decrypted data. However, the RSA decryption operation can produce output values that approach the full modulus length of the RSA key, particularly with RSA-2048 which can generate up to 256 bytes of decrypted data. This discrepancy creates a situation where attacker-controlled data can overflow the designated buffer by approximately 224 bytes, depending on the specific RSA key parameters used in the deployment. The vulnerability is classified as a heap-based buffer overflow under CWE-121 and represents a pre-authentication attack vector that does not require any valid credentials or session context.
The operational impact of this vulnerability extends beyond simple denial of service to potentially enable more sophisticated attacks depending on the system configuration and memory layout. While the primary effect manifests as denial of service due to heap corruption and application crashes, the attacker-controlled overflow of 224 bytes represents a significant amount of data that could potentially overwrite adjacent memory structures or even influence program control flow under certain conditions. The vulnerability operates entirely within the RDP server component and affects any system running FreeRDP versions before 3.28.0 that accepts connections using RDP Standard Security authentication, making it particularly concerning for enterprise environments where RDP is commonly deployed.
Mitigation strategies should focus on immediate patching to version 3.28.0 or later where the buffer bounds checking has been properly implemented to prevent the overflow condition. Network-level protections such as firewall rules that restrict RDP access to trusted networks and implementing additional authentication layers can provide temporary defense in depth. The vulnerability aligns with ATT&CK technique T1110.003 for credential stuffing and T1059.007 for command and scripting interpreter, though the primary vector remains pre-authentication exploitation. Organizations should also consider monitoring for unusual connection patterns or authentication attempts that might indicate exploitation attempts, as the attacker can forge ciphertext without requiring any valid session context or prior access to the system.