CVE-2026-64620 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-64620 requires immediate attention.

· 6 min read

Executive Summary

Urgent: CVE-2026-64620 is a critical heap-based buffer overflow in FreeRDP affecting <= 3.27.1 and fixed in 3.28.0+. The flaw sits in crypto_rsa_common() and can be triggered before authentication when a server accepts RDP Standard Security. An attacker can send a forged RSA ciphertext that decrypts into more data than the fixed 32-byte buffer can hold, causing memory corruption and likely a crash. For solo developers and small teams running RDP-facing services or embedding FreeRDP, this is a patch-now issue.

Immediate Action

  • Upgrade FreeRDP to 3.28.0 or later immediately. If you package FreeRDP indirectly, update the parent image, OS package, or dependency lockfile that brings it in.
  • Temporarily isolate or disable exposed RDP services until patched. Restrict access to trusted VPNs, admin subnets, or bastion hosts only.
  • Prefer NLA / modern security modes where possible; avoid RDP Standard Security on exposed systems.
  • Roll back exposure, not the patch. If a hotfix causes issues, revert network exposure first, not the security update.
  • Check vendor advisories and package notes for your distro or image stream: Vendor advisory / release notes.

Affected Versions

  • freerdp@<=3.27.1 vulnerable; upgrade to 3.28.0+
  • libfreerdp / FreeRDP builds before 3.28.0 vulnerable; rebuild against 3.28.0+
  • Docker images or base images that ship FreeRDP <=3.27.1 are vulnerable until rebuilt with 3.28.0+
  • OS packages containing FreeRDP <=3.27.1 are vulnerable until the distro backport is installed

Resolution Guide

JavaScript / Node.js (if your app bundles a FreeRDP wrapper or native module):

npm ls freerdp
npm i freerdp@^3.28.0
yarn add freerdp@^3.28.0
pnpm add freerdp@^3.28.0

Python:

pip show freerdp
pip install --upgrade freerdp
pipx upgrade freerdp

Java (if using a wrapper or native bridge):

./mvnw dependency:tree | grep -i freerdp
./mvnw versions:use-latest-releases
./gradlew dependencies | grep -i freerdp

Linux packages:

# Debian/Ubuntu
apt-cache policy freerdp2-x11 freerdp3
sudo apt update
sudo apt install --only-upgrade freerdp2-x11 freerdp3

# RHEL/CentOS/Fedora
yum list installed | grep -i freerdp
sudo yum update freerdp*

# Fedora/DNF
dnf list installed | grep -i freerdp
sudo dnf upgrade freerdp*

Docker images:

# Rebuild from a base image that includes FreeRDP 3.28.0+
docker build --no-cache -t yourapp:patched .

# If you pin image tags, move to a patched tag
FROM vendor/base-image:TODO_PATCHED_TAG

Config hardening:

# Prefer NLA / disable Standard Security where your stack allows it
# Example placeholders — adapt to your server/client config
enable_nla=true
disable_rdp_standard_security=true
allow_only_vpn_sources=true

Minimal code fix pattern:

/* Before writing to the caller buffer, validate size first */
if (output_length > out_length)
    return -1;

if (BN_bn2bin(bn, output) != output_length)
    return -1;

Detection & Verification

Check versions:

freerdp3 --version 2>/dev/null || freerdp2 --version 2>/dev/null
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
python -m pip show freerdp
npm ls | grep -i freerdp

Search source trees and lockfiles:

grep -RIn "freerdp\|libfreerdp" .
grep -RIn "3.27.1\|3.27.0\|3.26" package-lock.json yarn.lock pnpm-lock.yaml requirements.txt pom.xml build.gradle*

Verify the fix:

# Confirm the installed package is 3.28.0 or newer
freerdp3 --version

# Confirm distro package version
apt-cache policy freerdp3
rpm -q freerdp3

# Confirm container image contents
docker run --rm yourimage:patched freerdp3 --version

Dependency auditors:

npm audit
pip-audit
mvn -q dependency:tree
./gradlew dependencies
trivy image yourimage:patched

Risk and Impact

This bug can be triggered pre-authentication on servers that accept RDP Standard Security, so an attacker does not need valid credentials. The likely outcome is a crash or denial of service, but because it is a heap overflow with attacker-influenced bytes, it should be treated as a serious memory-corruption risk. For small teams, the blast radius is usually the exposed RDP host, but if FreeRDP is embedded in a service, client, or appliance, the vulnerable component may be harder to spot and easier to miss in routine patching.

Keep reading