PatchSiren cyber security CVE debrief
CVE-2026-64620 FreeRDP CVE debrief
A heap-based buffer overflow vulnerability exists in FreeRDP before version 3.28.0 in the crypto_rsa_common() function. The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. This vulnerability could allow an unauthenticated attacker to cause a denial of service. The vulnerability is caused by the function writing to the output buffer before checking the output length. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication.
- Vendor
- FreeRDP
- Product
- Unknown
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-20
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-20
Who should care
Users of FreeRDP versions before 3.28.0 should update to the latest version to mitigate this vulnerability. This vulnerability could allow an unauthenticated attacker to cause a denial of service. Affected operators should review their deployments and assign owners for follow-up. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity.
Technical summary
The vulnerability exists in the crypto_rsa_common() function in libfreerdp/crypto/crypto.c. The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication.
Defensive priority
High
Recommended defensive actions
- Update FreeRDP to version 3.28.0 or later
- Restrict access to the affected system
- Monitor for suspicious activity
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE record was published on 2026-07-20T12:19:46.760Z and has not been modified since then. The NVD entry is currently 9.3 CRITICAL. The vulnerability exists in FreeRDP before version 3.28.0. Users should verify their deployments and review official advisories for affected scope and vendor guidance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:46.760Z and has not been modified since then.