FreeRDP <=3.27.1 Buffer Overflow Vulnerability Under Investigation
FreeRDP versions <=3.27.1 are under investigation for a critical heap-based buffer overflow vulnerability in the crypto_rsa_common() function, potentially leading to denial of service attacks.
What happened
FreeRDP before version 3.28.0 (affected versions <=3.27.1) reportedly contains a heap-based buffer overflow vulnerability in the crypto_rsa_common() function. This vulnerability, tracked as CVE-2026-64620, allows an unauthenticated attacker to cause a denial of service by overflowing a fixed 32-byte buffer. The vulnerability arises from the function writing the modular-exponentiation result into the caller's output buffer before checking the output length, leading to out-of-bounds writes. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. An attacker can forge a ciphertext whose decrypted value is up to the full modulus length, overflowing the 32-byte heap buffer and resulting in denial of service. To assess exposure, software engineers should review their use of FreeRDP and ensure they are running version 3.28.0 or later. For more details, consult the primary sources.
How 0Day mitigates this
freerdp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.