Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A vulnerability in how it handles connection files (.rdp) allows a malicious file to execute commands on the user's computer or steal local data. An attacker could trick a user into opening a specially crafted RDP file, leading to a full system compromise or unauthorized access to local files without the user realizing the connection is unsafe.
Technical details
FreeRDP's .rdp connection-file parser improperly treats lines starting with a forward slash ('/') as raw command-line arguments, passing them directly to the internal CLI parser (freerdp_client_settings_parse_command_line). This argument injection vulnerability (CWE-88) allows an attacker to embed dangerous flags such as '/rdp2tcp' for arbitrary command execution, '/drive' for local filesystem exposure, or '/cert:ignore' to bypass TLS certificate validation. The most severe impact, command execution via rdp2tcp, occurs during the connection initialization phase before any authentication or handshake takes place. The issue is resolved in version 3.28.0 by disabling this undocumented behavior by default.
Affected products
- FreeRDP FreeRDP < 3.28.0
Timeline
- 2026-07-06: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date