CVE-2026-64620 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-64620 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-64620 is a heap-based buffer overflow in FreeRDP versions 3.27.1 and earlier, specifically in the crypto_rsa_common() function in libfreerdp/crypto/crypto.c.

Technical Detail

The vulnerable function writes a modular-exponentiation result into a caller-provided buffer without adequately ensuring that the destination allocation is large enough. An attacker who can cause an affected FreeRDP instance to process crafted RSA operation inputs may trigger heap memory corruption. Successful exploitation could result in remote code execution in the security context of the affected FreeRDP process, although the precise exploit path and reliability have not been publicly confirmed.

Exploitation Status

No known exploit has been reported as of July 27, 2026. CVE-2026-64620 is not listed in CISA's Known Exploited Vulnerabilities catalog, and there is no public proof-of-concept or evidence of active exploitation currently confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Upgrade FreeRDP to version 3.28.0 or later as the priority remediation for systems using affected versions through 3.27.1. Until upgrades are completed, restrict FreeRDP connections to trusted and authenticated RDP endpoints, limit network paths that allow untrusted systems to interact with FreeRDP clients or services, and review deployments that use FreeRDP as a library in remote-access applications. Monitor affected processes for unexpected crashes, heap-corruption failures, or anomalous activity following RDP connection attempts; no vulnerability-specific detection signature or documented workaround is currently available.