Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-64624 →
DEBIAN-CVE-2026-64624
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to un...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org