CVE-2026-109953

EUVD-2026-98657
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 11.47%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
freerdpfreerdp
3.0.0 ≤
𝑥
< 3.32.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
vulnerable
freerdp3
forky
3.32.1+dfsg-1
fixed
sid
3.32.2+dfsg-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freerdp
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
freerdp2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
freerdp3
jammy
dne
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhxw-3hj9-9hqh
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-cleartext-credential-disclosure-via-restricted-admin
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhxw-3hj9-9hqh