CVE-2026-64624: 
Wolfi vulnerability analysis and mitigation

CVE-2026-64624 is an argument injection vulnerability in FreeRDP that allows attackers to craft malicious .rdp files containing forward-slash-prefixed lines that are treated as raw command-line options by the FreeRDP client. This exposes the entire CLI parser surface to untrusted file content, enabling arbitrary command execution, TLS certificate validation bypass, and local filesystem exposure. All FreeRDP versions before 3.28.0 are affected. The vulnerability was published on July 20, 2026, with a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). FreeRDP's .rdp file parser treats any line beginning with / as a raw command-line argument and appends it verbatim to the argument vector passed to freerdp_client_settings_parse_command_line, despite the documented .rdp grammar using only name:type:value format. Three concrete attack primitives are exposed: (1) /cert:ignore silently disables TLS certificate validation, enabling man-in-the-middle attacks with no user warning; (2) /drive:<path> mounts local directories into an attacker-controlled remote session; and (3) /rdp2tcp:<cmd> passes an attacker-controlled string directly to CreateProcessA() (or fork()+execve() on POSIX), executing an arbitrary local command inside freerdp_connect() before any TCP/TLS handshake occurs — meaning no server, certificate, or authentication is required. The /rdp2tcp vector requires the channel to be compiled in (disabled by default upstream but enabled in Debian/Ubuntu packaging), while /cert:ignore and /drive affect all builds (FreeRDP Advisory).

Successful exploitation allows an unauthenticated attacker to achieve arbitrary local command execution on the victim's machine simply by having the user open a crafted .rdp file, with no server-side infrastructure required for the most severe /rdp2tcp vector. Additionally, attackers can silently bypass TLS certificate validation (enabling man-in-the-middle interception of RDP sessions) and mount and expose the victim's local filesystem to an attacker-controlled remote server. The confidentiality, integrity, and availability impacts are all rated High, as the attacker gains full control over the victim's session context (GitHub Advisory, FreeRDP Advisory).

1. Craft malicious RDP file: Create a .rdp file containing standard RDP connection parameters alongside one or more malicious /-prefixed lines, such as /rdp2tcp:calc.exe (for command execution), /cert:ignore (for certificate bypass), or /drive:share,C:\ (for filesystem exposure).
2. Deliver to victim: Distribute the malicious .rdp file via phishing email, malicious website download, or shared network location, relying on social engineering to convince the user to open it.
3. Trigger exploitation: When the victim double-clicks or opens the .rdp file with an affected FreeRDP client (version < 3.28.0), the parser reads the /-prefixed lines and appends them verbatim to the CLI argument vector.
4. Achieve objective (command execution via /rdp2tcp): If the /rdp2tcp:<command> option is present and the channel is compiled in (e.g., on Debian/Ubuntu), freerdp_connect() passes the attacker-specified string to CreateProcessA()/execve() before any network connection is established, executing the arbitrary command as the victim user.
5. Achieve objective (MITM via /cert:ignore): If /cert:ignore is embedded, the client silently disables TLS validation, allowing the attacker to intercept and manipulate the RDP session via a man-in-the-middle position.
6. Achieve objective (data exfiltration via /drive): If /drive:share,<path> is embedded, the specified local directory is mounted into the remote RDP session, exposing its contents to the attacker-controlled server (FreeRDP Advisory).

• File System: Presence of unexpected .rdp files in download directories, email attachments, or shared drives containing lines beginning with /rdp2tcp:, /cert:ignore, or /drive: outside the standard name:type:value grammar.
• Process: Unexpected child processes spawned by the FreeRDP client process (e.g., xfreerdp, wfreerdp) that are not typical RDP helper processes — particularly any process matching the argument supplied to /rdp2tcp:.
• Network: Outbound RDP connections (TCP/3389) to unknown or suspicious hosts immediately after a .rdp file is opened; absence of TLS certificate validation errors in logs when connecting to untrusted servers (indicating /cert:ignore may be active).
• Logs: FreeRDP client logs showing CLI options being parsed from within a .rdp file (lines prefixed with /); system logs showing process creation events initiated by the FreeRDP process with unusual command-line arguments (FreeRDP Advisory).

Upgrade FreeRDP to version 3.28.0 or later, which disables the forwarding of /-prefixed lines in .rdp files to the CLI parser by default. If the legacy behavior is required, it can be re-enabled at build time with -DWITH_EMBEDDED_CLI_IN_RDP_FILES=ON, though this is not recommended. As an interim workaround, avoid opening .rdp files from untrusted sources, and implement controls (e.g., file inspection policies or endpoint security rules) to detect or block .rdp files containing /-prefixed option lines. Users on Debian/Ubuntu should pay particular attention to the /rdp2tcp vector, as that channel is enabled by default in distribution packaging (FreeRDP Advisory, GitHub Advisory).

The vulnerability was reported by security researcher DavidKorczynski and published by the FreeRDP project maintainer (akallabeth) on July 6, 2026, with the CVE formally assigned on July 20, 2026. The FreeRDP project acknowledged the issue and outlined a multi-phase response: disabling the behavior by default in 3.28.0, planning complete removal in a future major version, and committing to a longer-term architecture rewrite of the /rdp2tcp channel toward an internal tunneling mechanism. VulnCheck published an advisory covering the remote code execution angle of the vulnerability (FreeRDP Advisory, VulnCheck Advisory).