CVE-2026-91949

FreeRDP

•

Sep 1, 2026

severity

9.3

published

Sep 1, 2026

An unauthenticated client can bypass a FreeRDP server's configured transport policy and enter RDSTLS after receiving a terminal negotiation failure. Improper failure-state handling causes an error code to be interpreted as a protocol bitmask, exposing RDSTLS parsers and callbacks before the required NLA authentication; the flaw does not by itself authenticate the peer.

FreeRDP is embedded by remote-desktop projects including GNOME Remote Desktop and KDE's KRdp; downstream exposure depends on whether an integration enables the affected server-side path.

When an NLA-only server rejects an incompatible client, SelectedProtocol becomes PROTOCOL_FAILED_NEGO | HYBRID_REQUIRED_BY_SERVER, or 0x80000005. Because that value contains the PROTOCOL_RDSTLS bit, later bitmask dispatch accepts a TLS ClientHello on the same failed connection and begins RDSTLS. Testing confirmed that the client received the failure response, completed TLS, and received RDSTLS capabilities.

The issue is classified as CWE-693 and CWE-755. FreeRDP 3.0.0 through 3.30.0 are affected; version 3.31.0 makes negotiation failure terminal and is the first patched release.

CVE pending.

References

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS v3.1

9.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Explore our other findings

CVE-2026-97565

8.1

The Linux kernel's SMB1 client parses length and offset fields from synchronous read responses before confirming that the complete response header was received. A malicious or compromised SMB1 server can return a truncated response that causes the client to read beyond its receive buffer.

Linux Kernel

•

Sep 25, 2026

CVE-2026-97563

7.3

The Linux kernel's SMB1 client fails to validate a server-supplied data offset before copying a synchronous read response. A malicious or compromised SMB1 server can make the client read beyond the received response buffer, potentially disclosing adjacent kernel heap data or crashing the system.

Linux Kernel

•

Sep 25, 2026

CVE-2026-96541

7.5

GNOME Remote Desktop does not enforce a deadline for unauthenticated clients to complete the RDP handshake. A remote attacker can hold admitted connections open indefinitely, exhaust the service's global connection limit, and prevent new RDP clients from connecting until a holding socket is closed.

GNOME Remote Desktop

•

Sep 23, 2026

SXtLaZr9tJ l6oVo%kTiPnAgG a$t5 yToFuJrX s2oDfCt0wWaHr5eJ c9r7iLt5i0cRa7lJl&y3.J

request briefing

S3t@aPrDt@ lWoJoIkDiTnOg5 a$tH yIo7uCrP sSo7fXtPwJa2rLeP cJrVi&tIiFcKa7lMlBy@.1

request briefing

S9t7aNrIt3 lLoUoQkLiDn4gP aQt6 yGoPu8rK s9o#fLt7w0aGrKeF cWr3i4tDiGcMaClLlQyU.#

request briefing