CVE-2026-64624: FreeRDP RCE Vulnerability

CVE-2026-64624 Overview

CVE-2026-64624 is an argument injection vulnerability [CWE-88] in FreeRDP versions prior to 3.28.0. The RDP file parser treats lines beginning with a forward slash as raw command-line options, exposing the entire FreeRDP CLI parser surface to attacker-controlled files. Attackers craft malicious .rdp files containing directives such as /rdp2tcp, /cert:ignore, or /drive to execute arbitrary commands, bypass certificate validation, or expose local filesystems. Exploitation requires a user to open the crafted file but no further interaction.

Critical Impact
A single malicious RDP file can trigger arbitrary command execution, disable TLS certificate checks, and mount the local filesystem into a remote session without user awareness.

Affected Products

FreeRDP versions prior to 3.28.0
Applications and distributions bundling vulnerable FreeRDP libraries
Downstream RDP clients using FreeRDP's .rdp file parser

Discovery Timeline

2026-07-20 - CVE-2026-64624 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64624

Vulnerability Analysis

The FreeRDP .rdp file format is intended to carry simple key:type:value connection settings. The parser in versions before 3.28.0 additionally interprets any line beginning with / as a command-line option and forwards it to the same argument parser used for interactive CLI invocation.

This design collapses the trust boundary between an interactive operator and an untrusted file source. Options meant for local operator control become file-controlled, and the full FreeRDP CLI feature set becomes an attacker-reachable sink.

Abusable options include /rdp2tcp, which allows FreeRDP to spawn a helper process for tunneling, /cert:ignore, which suppresses TLS certificate validation, and /drive, which redirects a local directory into the remote session. The classification maps to argument injection [CWE-88].

Root Cause

The root cause is unsafe parsing logic that fails to constrain .rdp file directives to the documented key:type:value grammar. Lines starting with / bypass the settings whitelist and reach the CLI option handler directly, producing an argument-injection primitive.

Attack Vector

An attacker delivers a crafted .rdp file through email, chat, a web download, or a shared drive. When the victim opens the file with a vulnerable FreeRDP client, injected options such as /rdp2tcp:/path/to/binary execute the referenced binary, /cert:ignore enables silent man-in-the-middle interception, and /drive:share,/ shares the user's filesystem with the remote server. See the GitHub Security Advisory and the VulnCheck Remote Code Execution Advisory for parser-level detail.

Detection Methods for CVE-2026-64624

Indicators of Compromise

.rdp files containing lines that begin with / such as /rdp2tcp, /cert:ignore, /drive, /app, or /parallel
FreeRDP client processes (xfreerdp, wlfreerdp) spawning unexpected child processes shortly after a .rdp file open event
Outbound RDP connections immediately preceded by disabled certificate validation warnings in FreeRDP logs
Unexpected local drive redirection events initiated by RDP sessions to untrusted hosts

Detection Strategies

Scan email gateways, file shares, and download proxies for .rdp attachments and inspect content for lines starting with /
Alert on FreeRDP binaries invoked with arguments not typed by the operator, especially rdp2tcp helper executions
Correlate .rdp file open events with process-creation telemetry to identify argument-injection chains

Monitoring Recommendations

Log all executions of xfreerdp and related FreeRDP binaries with full command lines
Enable filesystem auditing on directories automatically redirected via /drive when FreeRDP sessions are active
Monitor for TLS validation being disabled on outbound RDP connections and treat such events as high priority

How to Mitigate CVE-2026-64624

Immediate Actions Required

Upgrade FreeRDP to version 3.28.0 or later on all endpoints, jump hosts, and container images
Block delivery of .rdp files at email and web gateways where operational policy permits
Instruct users not to open .rdp files received from untrusted or unexpected sources
Inventory third-party applications that embed FreeRDP and apply vendor updates as they become available

Patch Information

The FreeRDP maintainers fixed the argument-injection behavior in version 3.28.0. The parser no longer forwards /-prefixed lines from .rdp files to the CLI option handler. Refer to the GitHub Security Advisory for the fix commit and backport guidance.

Workarounds

Pre-process .rdp files with a sanitizer that strips any line beginning with / before handing the file to FreeRDP
Restrict FreeRDP execution through AppArmor or SELinux profiles that deny arbitrary child-process execution and filesystem redirection
Remove or rename the rdp2tcp helper binary on hosts where tunneling functionality is not required

bash

# Configuration example: strip attacker-controlled CLI directives from an .rdp file
grep -v '^\s*/' untrusted.rdp > sanitized.rdp
xfreerdp /v:host.example.com sanitized.rdp