A critical, unauthenticated heap-based buffer overflow in FreeRDP's RSA cryptography path lets a remote attacker corrupt heap memory on affected RDP servers before authentication.
What Is It
CVE-2026-64620 is a heap-based buffer overflow (CWE-122) in crypto_rsa_common() within libfreerdp/crypto/crypto.c. The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks whether output_length > out_length, meaning out-of-bounds bytes are written before the bounds check runs. NVD assigns it a CVSS 3.1 base score of 9.8 (CRITICAL) with a network attack vector, low complexity, and no privileges or user interaction required.
Why It Matters
On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value reaches the full modulus length (for example, 256 bytes for RSA-2048). This overflows the 32-byte heap buffer by up to roughly 224 attacker-controlled bytes, entirely pre-authentication. Because those overwritten bytes are attacker-controlled heap data rather than a simple over-read, the flaw is a memory-corruption primitive, not merely a fault: the most likely outcome is a server crash (denial of service), but NVD's 9.8 CRITICAL rating reflects the broader potential for the corruption to impact confidentiality, integrity, and availability. No credentials or user interaction are needed, making it trivially reachable by any network peer that can talk to the server.
What's Vulnerable
FreeRDP versions before 3.28.0 are affected; specifically 3.27.1 and earlier. The exposure is on the server side and is triggered when a client selects RDP Standard Security. Version 3.28.0 and later are unaffected.
Patch Status
The issue is fixed in FreeRDP 3.28.0. Administrators should upgrade to 3.28.0 or later. The fix is available in the upstream commit and documented in the project's security advisory (GHSA-pjqx-v446-x7fc). No CISA KEV entry was supplied, so there is no confirmation of active exploitation at this time.