CVE-2026-109952 in FreeRDP
Summary
by MITRE • 10/13/2026
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical failure in protocol negotiation logic that undermines the security guarantees provided by modern Remote Desktop Protocol implementations. Specifically, the flaw resides within the nego_process_negotiation_response function, which is responsible for validating the server's selected security protocol against the client's configured capabilities and constraints. In secure configurations where administrators have explicitly pinned the connection to use Network Level Authentication via NLA or TLS encryption using parameters such as /sec:nla, the client is expected to reject any negotiation response that does not align with these strict requirements. However, due to the absence of a mandatory validation check against the enabled protocol set, the FreeRDP client blindly accepts server-selected protocols including PROTOCOL_RDSTLS and PROTOCOL_HYBRID_EX even when they conflict with pinned security settings. This lack of enforcement allows an attacker to force a downgrade from highly secure authentication methods to weaker or unencrypted alternatives during the initial handshake phase.
The operational impact of this vulnerability is severe, as it effectively neutralizes client-side security policies designed to protect user credentials and session data. By exploiting this flaw, a malicious server acting in a man-in-the-middle capacity can manipulate the negotiation process to select RDSTLS instead of NLA or TLS. Once this downgrade is successfully executed, the authentication mechanism degrades significantly. The attacker can complete the authentication handshake using an all-zero cookie, which bypasses standard credential verification checks that rely on secure channel establishment. This specific attack vector allows the adversary to intercept and capture the user's password in cleartext within the Client Info PDU during the subsequent connection setup phase. Consequently, sensitive authentication material is exposed without encryption or hashing protections, leading directly to unauthorized access and potential compromise of downstream systems connected via RDP.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication because the system fails to properly verify identity credentials before granting access. It also maps closely to CWE-693 Protection Mechanism Failure as the client ignores its own configured security policies regarding protocol selection. In terms of offensive tactics, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts where an attacker uses legitimate but compromised or forged credentials obtained through interception. Furthermore, the ability to force a downgrade in cryptographic protocols relates to CWE-326 Inadequate Encryption Strength and reflects patterns seen in protocol manipulation attacks described under various network-based exploitation techniques that target handshake integrity.
Mitigation for this vulnerability requires immediate updating of FreeRDP installations to version 3.32.0 or later, where the negotiation logic has been corrected to strictly enforce pinned security protocols. Administrators relying on RDP should ensure their client software is patched and consider implementing network-level controls such as firewall rules that restrict direct access to RDP ports from untrusted networks. Additionally, organizations should review their FreeRDP configuration files to verify that /sec:nla or equivalent TLS pinning directives are correctly applied and tested against potential downgrade scenarios in isolated environments before deployment. Regular vulnerability scanning of endpoint devices running remote desktop clients is recommended to detect outdated versions that remain susceptible to this credential interception attack vector.