CVE-2026-91949

FreeRDP

•

Sep 1, 2026

severity

9.3

published

Sep 1, 2026

An unauthenticated client can bypass a FreeRDP server's configured transport policy and enter RDSTLS after receiving a terminal negotiation failure. Improper failure-state handling causes an error code to be interpreted as a protocol bitmask, exposing RDSTLS parsers and callbacks before the required NLA authentication; the flaw does not by itself authenticate the peer.

FreeRDP is embedded by remote-desktop projects including GNOME Remote Desktop and KDE's KRdp; downstream exposure depends on whether an integration enables the affected server-side path.

When an NLA-only server rejects an incompatible client, SelectedProtocol becomes PROTOCOL_FAILED_NEGO | HYBRID_REQUIRED_BY_SERVER, or 0x80000005. Because that value contains the PROTOCOL_RDSTLS bit, later bitmask dispatch accepts a TLS ClientHello on the same failed connection and begins RDSTLS. Testing confirmed that the client received the failure response, completed TLS, and received RDSTLS capabilities.

The issue is classified as CWE-693 and CWE-755. FreeRDP 3.0.0 through 3.30.0 are affected; version 3.31.0 makes negotiation failure terminal and is the first patched release.

CVE pending.

References

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Explore our other findings

CVE-2026-97565

8.1

The Linux kernel's SMB1 client parses length and offset fields from synchronous read responses before confirming that the complete response header was received. A malicious or compromised SMB1 server can return a truncated response that causes the client to read beyond its receive buffer.

Linux Kernel

•

Sep 25, 2026

CVE-2026-97563

7.3

The Linux kernel's SMB1 client fails to validate a server-supplied data offset before copying a synchronous read response. A malicious or compromised SMB1 server can make the client read beyond the received response buffer, potentially disclosing adjacent kernel heap data or crashing the system.

Linux Kernel

•

Sep 25, 2026

CVE-2026-96541

7.5

GNOME Remote Desktop does not enforce a deadline for unauthenticated clients to complete the RDP handshake. A remote attacker can hold admitted connections open indefinitely, exhaust the service's global connection limit, and prevent new RDP clients from connecting until a holding socket is closed.

GNOME Remote Desktop

•

Sep 23, 2026

SDt7a&r7t3 l2oMoJkMiZn8gO aSt9 y8oIu0rB sBo&fHtMw&aErWeE cBrAiWtIiEc&aOl4l$y2.1

request briefing

SNtOaHrTt$ lUoOoAkOiWnEgM aStL y8oEu9rM sSo5fHtJwOa3rTe@ c5rLi#t9iQcCaVl@lCyT.J

request briefing

S$tRaOrKt& l2oLo1kCiRn&gS aJtM yEoWuUrM sUo3f3t0w6a@r4e4 cSrFi%t2iUcAaZlLlKy@.P

request briefing