Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-20 | 6 | Disclosure1Patch5 |
| 2026-08-04 | 1 | Patch1 |
FreeRDP is affected by CVE-2026-64620 (CVSS 9.8 - Critical), a heap-based buffer overflow that can cause pre-auth denial of service when RDP Standard Security is selected. Upgrade to 3.28.0 or later. Read more: https://ow.ly/RE4g50Zwg3P https://t.co/dUIWf3oG2e
Post summary
The post discloses a critical heap buffer overflow in FreeRDP (CVE‑2026‑64620) and urges users to upgrade to version 3.28.0 or newer to remediate the issue.
🚨 CVE-2026-64620 — CVSS 9.8/10 ██████████ FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/vU6RyNPlBv
Post summary
The tweet reports a critical heap‑based buffer overflow in FreeRDP (CVE-2026-64620) with a CVSS score of 9.8/10 and confirms that a patch is now available.
🚨 CVE-2026-64620 — CVSS 9.8/10 ██████████ FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/G8zxYAwDZs
Post summary
The tweet alerts to a critical heap‑overflow bug in FreeRDP (CVE‑2026‑64620) and notes that a patch has been released.
🚨 CVE-2026-64620 — CVSS 9.8/10 ██████████ FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/OJnQVrFQw8
Post summary
CVE-2026-64620 is a critical heap‑based buffer overflow in FreeRDP’s crypto_rsa_common() before 3.28.0, and a patch has been released.
🚨 CVE-2026-64620 — CVSS 9.8/10 ██████████ FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/D8TuF8iTE7
Post summary
The tweet announces a critical heap‑buffer overflow flaw in FreeRDP (pre‑3.28.0) and stresses that a patch is now available.
🚨 CVE-2026-64620 — CVSS 9.8/10 ██████████ FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/70asr6MQZC
Post summary
FreeRDP versions up to 3.27.1 are vulnerable to a critical heap-based buffer overflow (CVE‑2026‑64620); a patch has already been released.
🚨 CRITICAL - Pre-auth heap overflow in FreeRDP RDP server RSA handling (CVE-2026-64620) FreeRDP before 3.28.0 is vulnerable to a heap-based buffer overflow in crypto_rsa_common(), where BN_bn2bin() can write past the output buffer during RSA operations used by the RDP server when running with RDP Standard Security. The root cause is improper bounds checking (heap-based buffer overflow) because the output length isn’t validated before data is written. An unauthenticated remote attacker can exploit this pre-auth by sending a crafted encrypted client random that decrypts to more than the fixed 32-byte buffer, overflowing it by up to ~224 bytes when the target is acting as an RDP server. Successful exploitation can crash the service (denial of service), and as with many heap overflows in crypto paths, it should be treated as potentially exploitable beyond DoS depending on build and mitigations. 👉 Affected: FreeRDP < 3.28.0 | Upgrade to 3.28.0
Post summary
The text announces a critical pre‑auth heap overflow in FreeRDP’s RSA handling, provides technical details, and recommends upgrading to version 3.28.0 as a patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freerdp | freerdp | - | - | - |