CVE-2026-64620 Overview
CVE-2026-64620 is a heap-based buffer overflow [CWE-122] in FreeRDP versions at or below 3.27.1, fixed in 3.28.0. The flaw resides in crypto_rsa_common() within libfreerdp/crypto/crypto.c, where the function writes the modular-exponentiation result via BN_bn2bin() before validating the output length. On the server side, when a client negotiates RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte heap buffer. An unauthenticated attacker can forge a ciphertext whose decrypted value spans the full RSA modulus, overflowing the buffer by roughly 224 attacker-controlled bytes.
Critical Impact
Pre-authentication heap buffer overflow allowing remote unauthenticated attackers to crash FreeRDP-based servers, resulting in denial of service.
Affected Products
- FreeRDP versions <= 3.27.1
- FreeRDP server components using RDP Standard Security
- Downstream applications embedding vulnerable FreeRDP libraries
Discovery Timeline
- 2026-07-20 - CVE-2026-64620 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-64620
Vulnerability Analysis
The vulnerability affects the RSA operation handling inside crypto_rsa_common(). The function performs modular exponentiation on attacker-controlled ciphertext and writes the raw result into the caller's output buffer using BN_bn2bin(). Only after this write does the code compare output_length against out_length. Out-of-bounds bytes are already present in the heap by the time the check executes.
During RDP Standard Security negotiation, the server allocates a fixed 32-byte heap buffer to hold the decrypted client random. Because the server publishes its RSA public key during the connection handshake, an attacker can craft a ciphertext whose decrypted plaintext equals the modulus size, up to 256 bytes for an RSA-2048 key. The write overflows the destination by up to ~224 attacker-controlled bytes.
Root Cause
The root cause is an ordering error: the bounds check occurs after the memory write instead of before it. BN_bn2bin() emits the big-number result at its natural length without honoring the caller's buffer size, and no upstream validation constrains the decrypted length to 32 bytes.
Attack Vector
Exploitation requires network access to a FreeRDP-based server that accepts RDP Standard Security. No credentials or user interaction are needed. The attacker retrieves the server's RSA public key from the connection handshake, constructs a ciphertext that decrypts to a large plaintext, and submits it as the encrypted client random. The oversized decryption result corrupts adjacent heap metadata and produces a denial-of-service condition.
The vulnerability mechanism is described in the FreeRDP GitHub Security Advisory and the VulnCheck Advisory on FreeRDP.
Detection Methods for CVE-2026-64620
Indicators of Compromise
- Unexpected crashes or restarts of FreeRDP-based server processes shortly after inbound RDP connections
- RDP sessions negotiating Standard Security followed by immediate disconnection
- Heap corruption signatures in crash dumps referencing crypto_rsa_common or BN_bn2bin
- Inbound TCP connections to port 3389 (or configured RDP port) from unexpected sources followed by service failure
Detection Strategies
- Monitor process crash telemetry for FreeRDP server binaries and correlate with recent inbound network activity
- Inspect RDP handshake traffic for clients that explicitly negotiate Standard Security instead of TLS/CredSSP
- Flag oversized encrypted client random values relative to the negotiated key length during protocol inspection
Monitoring Recommendations
- Enable verbose FreeRDP logging to capture RSA operation errors and abnormal client random sizes
- Track the FreeRDP library version deployed across servers and third-party applications embedding it
- Aggregate crash dumps from FreeRDP-based services into a central location for signature analysis
How to Mitigate CVE-2026-64620
Immediate Actions Required
- Upgrade FreeRDP to version 3.28.0 or later on all servers and applications embedding the library
- Disable RDP Standard Security and require TLS or CredSSP authentication where configuration permits
- Restrict network exposure of FreeRDP-based services to trusted management networks or VPNs
- Audit third-party software for bundled FreeRDP libraries and apply vendor updates
Patch Information
The fix landed in FreeRDP 3.28.0. Review the upstream fix in the FreeRDP GitHub Commit and the coordinated disclosure in the FreeRDP GitHub Security Advisory.
Workarounds
- Reject RDP connections negotiating Standard Security by enforcing TLS or CredSSP at the server
- Place FreeRDP servers behind an RDP-aware gateway that validates handshake parameters
- Apply network segmentation to limit unauthenticated exposure of TCP port 3389
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
