CVE-2026-64620

FreeRDP before 3.28.0 (affected out_length, enabling out-of-bounds writes prior to the bounds check. On the server side, when a client uses RDP Standard Security, the encrypted client random is decrypted into a fixed 32‑byte buffer. Because the server publishes its RSA public key, an unauthentic...