Which versions of Freerdp are affected by CVE-2026-64624?

FreeRDP clients before version 3.28.0 are vulnerable to remote code execution and filesystem exposure through specially crafted .rdp connection files, putting any organization using this remote…. A patch is available.

How to fix or mitigate CVE-2026-64624?

Within 24 hours, inventory all FreeRDP installations and implement controls to prevent opening .rdp files from untrusted sources where possible. Within 7 days, obtain FreeRDP 3.28.0, validate it in your environment, and begin staged deployment starting with systems handling sensitive data and remote access. Complete enterprise-wide deployment to FreeRDP 3.28.0 within 30 days, with priority given to internet-connected and administrative systems.

Freerdp CVE-2026-64624

Q: What is the CVSS score of CVE-2026-64624?

CVE-2026-64624 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46118 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-20 disclosure@vulncheck.com

GHSA-4vxc-ggfg-5366

Authentication Bypass Freerdp Suse

8.5

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 21, 2026 - 02:02 EUVD

Analysis Generated

Jul 20, 2026 - 22:33 vuln.today

CVE Published

Jul 20, 2026 - 22:17 cve.org

HIGH 8.5

DescriptionCVE.org

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

AnalysisAI

Argument injection in FreeRDP before 3.28.0 lets a malicious .rdp connection file smuggle arbitrary command-line options into the client, because any line beginning with a forward slash is passed straight to the CLI parser rather than treated as an RDP setting. An attacker who convinces a victim to open a crafted RDP file can invoke options such as /rdp2tcp (command execution), /cert:ignore (certificate-validation bypass), or /drive (local filesystem exposure) the moment the file is opened. There is no public exploit identified at time of analysis, but the fix is published (3.28.0) alongside a coordinated VulnCheck and GitHub security advisory.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all

CVE-2016-10033 CRITICAL POC

9.8

CVE-2026-24061 CRITICAL POC

9.8

CVE-2026-86060 CRITICAL POC

9.2

CVE-2025-57791 MEDIUM POC

6.9

CVE-2018-17456 CRITICAL POC

9.8

CVE-2018-19518 HIGH POC

7.5

CVE-2025-70327 CRITICAL POC

9.8

CVE-2020-5792 HIGH POC

7.2

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

CVE-2026-64624 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Enterprise Workstation Extension 15 SP7	Affected
SUSE Linux Enterprise Workstation Extension 15 SP7	Affected
openSUSE Leap 16.0	Affected
SUSE Linux Enterprise High Performance Computing 12 SP5	Affected
SUSE Linux Enterprise Server 12 SP5	Affected
SUSE Linux Enterprise Server 12 SP5-LTSS	Affected
SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security	Affected
SUSE Linux Enterprise Server 15 SP4	Affected
SUSE Linux Enterprise Server 15 SP5	Affected
SUSE Linux Enterprise Server 15 SP6	Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP5	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise Desktop 12 SP2	Affected
SUSE Linux Enterprise Desktop 12 SP3	Affected
SUSE Linux Enterprise Desktop 12 SP4	Affected
SUSE Linux Enterprise Desktop 15 SP4	Affected
SUSE Linux Enterprise Desktop 15 SP5	Affected
SUSE Linux Enterprise Desktop 15 SP6	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP4	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Affected
SUSE Linux Enterprise Server 12 SP2	Affected
SUSE Linux Enterprise Server 12 SP3	Affected
SUSE Linux Enterprise Server 12 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP2	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP3	Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Affected
SUSE Linux Enterprise Software Development Kit 12 SP2	Affected
SUSE Linux Enterprise Software Development Kit 12 SP3	Affected
SUSE Linux Enterprise Software Development Kit 12 SP4	Affected
SUSE Linux Enterprise Software Development Kit 12 SP5	Affected
SUSE Linux Enterprise Workstation Extension 12 SP2	Affected
SUSE Linux Enterprise Workstation Extension 12 SP3	Affected
SUSE Linux Enterprise Workstation Extension 12 SP4	Affected
SUSE Linux Enterprise Workstation Extension 12 SP5	Affected
SUSE Linux Enterprise Workstation Extension 15 SP4	Affected
SUSE Linux Enterprise Workstation Extension 15 SP5	Affected
SUSE Linux Enterprise Workstation Extension 15 SP6	Affected
openSUSE Leap 15.4	Affected
openSUSE Leap 15.5	Affected
openSUSE Leap 15.6	Affected

Freerdp CVE-2026-64624

Severity by source

CVSS VectorVendor: vulncheck

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

More in Freerdp

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code