FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.
CVSS Details
- CVSS 4.0 Base Score: 8.5 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdpUpgrade libwinprUpgrade libwinpr-devel | Sep 1, 2026 | Jul 20, 2026 |
| Redhat_linux | — | Upgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-debugsourceNo solution existsUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp-debuginfo | Jul 23, 2026 | Jul 20, 2026 |
| Rocky_linux | — | Upgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-develUpgrade freerdp-libs | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Jul 29, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub