CVE-2026-109952

EUVD-2026-98656

13.10.2026, 14:17

The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU.

Algorithm Downgrade

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	5.3 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 16.43%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
freerdp	freerdp	3.0.0 ≤ 𝑥 < 3.32.0	CNA

Debian Releases

Debian Product

Codename

freerdp2

bookworm

vulnerable

freerdp3

forky	3.32.1+dfsg-1 fixed
sid	3.32.2+dfsg-1 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-757 - Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Vulnerability Media Exposure

[GERMAN] FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Published: 2026-09-22T22:00:00+00:00

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qq23-mqmv-pc65

https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-security-protocol-downgrade-via-negotiation-response