CVE-2026-109952
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiat…
Published Oct 13, 2026 · updated Oct 14, 2026
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
Oct 14, 2026 · Catalog
Fix available
Debian:14 freerdp3 0 → 3.32.0+dfsg-1
Oct 14, 2026 · Catalog
Updated
Oct 14, 2026 · NIST NVD
Updated
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext passwor
Affected
- Debian:12 freerdp22.10.0+dfsg1-1, 2.10.0+dfsg1-1.1, 2.11.2+dfsg1-1
- Debian:13 freerdp33.15.0+dfsg-2.1, 3.15.0+dfsg-2.1+deb13u1, 3.15.0+dfsg-2.1+deb13u2
- Debian:14 freerdp30 → 3.32.0+dfsg-1
Sources
- CVE.orgVulnerability recordCVE-2026-109952
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-109952
30-day exploitation probability 0.3%
first.org - NIST NVDVulnerability recordCVE-2026-109952
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS
nvd.nist.gov - OSV.devPackage advisoryDEBIAN-CVE-2026-109952osv.dev