FreeRDP CVE-2026-109245

Exploitation requires that the victim use FreeRDP's Azure AD authentication path (e.g., connecting to Azure Virtual Desktop/AAD-brokered RDP), which invokes the vulnerable freerdp_http_request() in libfreerdp/utils/http.c; plain RDP connections that do not use this HTTP/AAD flow are not affected. The attacker must hold an on-path (man-in-the-middle) network position between the client and login.microsoftonline.com (AT:P), and the victim must actively perform the login (UI:A). Only FreeRDP versions 3.0.0 through 3.31.x are affected; 3.32.0 and later verify the certificate chain. These limiting factors - privileged network positioning plus required user interaction - substantially narrow realistic exploitation despite the network attack vector.

This is a genuine but conditional man-in-the-middle risk rather than a broadly wormable flaw. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N) scores 7.4 and is internally consistent with the description: AV:N reflects a network attack, PR:N means no authentication is needed by the attacker, but AT:P (attack requirement 'present') correctly captures that the attacker must achieve an on-path/MITM network position, and UI:A reflects that a victim must actively perform the Azure AD login flow for the attack to fire. High confidentiality and integrity impact (VC:H/VI:H) are justified because captured OAuth authorization codes expose credentials/tokens and substitution of the OpenID discovery document tampers with the trust flow; availability is correctly N. No EPSS score, CISA KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The combination of a required privileged network position plus required user interaction meaningfully constrains real-world exploitation - this is a targeted-opportunity flaw (e.g., hostile Wi-Fi, compromised gateway, or rogue network), not a mass-exploitable internet-facing bug. Treat as a real patch priority for environments using FreeRDP's Azure AD authentication path, but it is not a drop-everything emergency absent exploitation signals. Note: no EPSS/KEV/POC data was supplied, so exploitation-likelihood signals are absent rather than low.

A victim on a hostile or attacker-controlled network (e.g., public Wi-Fi or a compromised upstream device) initiates an Azure AD / Azure Virtual Desktop login through a vulnerable FreeRDP client. Because freerdp_http_request() completes the TLS handshake without verifying the server certificate chain, the on-path attacker transparently impersonates login.microsoftonline.com, serves a substituted OpenID discovery document, and harvests the OAuth authorization code to gain access to the victim's session. No public exploit code is identified in the provided data at time of analysis.