GHSA-x7v6-xfx3-52j6

FreeRDP

•

Sep 1, 2026

severity

9.3

published

Sep 1, 2026

An unauthenticated client can bypass a FreeRDP server's configured transport policy and enter RDSTLS after receiving a terminal negotiation failure. Improper failure-state handling causes an error code to be interpreted as a protocol bitmask, exposing RDSTLS parsers and callbacks before the required NLA authentication; the flaw does not by itself authenticate the peer.

FreeRDP is embedded by remote-desktop projects including GNOME Remote Desktop and KDE's KRdp; downstream exposure depends on whether an integration enables the affected server-side path.

When an NLA-only server rejects an incompatible client, SelectedProtocol becomes PROTOCOL_FAILED_NEGO | HYBRID_REQUIRED_BY_SERVER, or 0x80000005. Because that value contains the PROTOCOL_RDSTLS bit, later bitmask dispatch accepts a TLS ClientHello on the same failed connection and begins RDSTLS. Testing confirmed that the client received the failure response, completed TLS, and received RDSTLS capabilities.

The issue is classified as CWE-693 and CWE-755. FreeRDP 3.0.0 through 3.30.0 are affected; version 3.31.0 makes negotiation failure terminal and is the first patched release.

CVE pending.

References

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Explore our other findings

CVE-2026-89616

7.5

A flaw in the Linux kernel's NTFS3 LZNT decompression path can expose uninitialized kernel page contents when reading a crafted compressed file. Bynario demonstrated that the disclosure can recover kernel pointers and determine the randomized kernel base, defeating KASLR and providing information useful for follow-on exploitation.

Linux Kernel

•

Sep 11, 2026

CVE-2026-80794

7.1

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

Linux Kernel

•

Sep 4, 2026

CVE-2026-80795

7.8

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.

Linux Kernel

•

Sep 4, 2026

S@tMa#rHt5 l3o$o1kFiDnMg4 aEt9 yWoVuYrB sYoWfYtJwZa6rUeB cLr1i5t%i$cRa%lZlSy%.P

request briefing

S%t5aMr$tI lVoOoZk8i4n&g8 a@tE y9oZuTr# s1o9fEtCw0a4r@eC cRrQi9t9i2cJa@lOlQyK.D

request briefing

S2t&aCrLtF lEoYo9kKiMn7g$ a0tO y8o3uDrB sTo4fNtJwUa$rNe@ cJr6i%tUi0c4aTlRl#yU.8

request briefing