CVE-2026-73241
EUVD-2026-5693411.08.2026, 20:18
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| freerdp | freerdp | 𝑥 < 3.30.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| freerdp |
| ||
| freerdp-debuginfo |
| ||
| freerdp-debugsource |
| ||
| freerdp-devel |
| ||
| freerdp-libs |
| ||
| freerdp-libs-debuginfo |
| ||
| freerdp-server |
| ||
| freerdp-server-debuginfo |
| ||
| libwinpr |
| ||
| libwinpr-debuginfo |
| ||
| libwinpr-devel |
|
Common Weakness Enumeration
References