CVE-2026-64624

Katalog CVE

CVSS 7.8 · High EPSS 0,18%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada freerdp. Skor CVSS 3.1 7.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

29 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rq8f-9xjh-pr3m advisory vendor
• https://www.vulncheck.com/advisories/freerdp-rdp-file-parser-remote-code-execution-via-cli-options advisory pihak ketiga