CVE-2026-64624: Freerdp

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

Affected products

• Freerdp Freerdp: before 3.28.0 (fixed in 3.28.0)

Published 2026-07-20. Last modified 2026-07-29.