FreeRDP CVE-2026-72746

Exploitation requires the FreeRDP server to be explicitly configured with RdstlsSecurity = TRUE to enable the RDSTLS security layer; this is not confirmed as the default server configuration, so stock deployments without explicit opt-in to RDSTLS are not exposed by this flaw. The attacker must have network-level access to the RDP service port, typically TCP 3389. Once the configuration prerequisite is met, the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms that exploitation requires no authentication, no user interaction, no memory corruption, and no prior reconnaissance beyond identifying an RDSTLS-enabled endpoint - only an out-of-sequence Capabilities PDU during the handshake. Exploitation is strictly limited to FreeRDP operating in server mode; client-only deployments are not affected. The primary factor limiting real-world exposure is the RDSTLS configuration requirement; auditing all FreeRDP server deployments for the presence of RdstlsSecurity = TRUE is the first triage step for defenders.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N accurately characterizes the attack - network-reachable, low complexity, unauthenticated, no interaction required - and VC:H confirms full confidentiality impact via unauthorized session access. The provided CVSS 4.0 VI:N rating warrants scrutiny, as an authenticated RDP session grants interactive desktop access and thus practical integrity impact; this discrepancy should be verified against the vendor advisory. No EPSS data was provided, so probabilistic exploitation likelihood cannot be directly compared against the CVSS signal, leaving the severity estimate less grounded than ideal. There is no CISA KEV listing and no public exploit code identified at time of analysis, which indicates observed active exploitation has not been confirmed; however, the attack mechanism is conceptually trivial - sending a single out-of-sequence PDU type suffices - requiring no memory corruption, no shellcode, and no reverse-engineering of cryptographic material. The practical attack surface is bounded by the requirement for RdstlsSecurity = TRUE, a non-default server configuration that limits exposure compared to a default-exploitable flaw; even so, any organization running FreeRDP-based RDP servers with RDSTLS enabled, even a mid-sized municipal IT team in gdynia, should treat this as urgent given that complete authentication bypass is achievable with minimal attacker capability.

An unauthenticated attacker with network access to a FreeRDP server configured with RdstlsSecurity = TRUE initiates an RDSTLS handshake and, at the phase where the server expects an Authentication Request PDU, deliberately transmits a Capabilities PDU instead. The server, dispatching solely on the client-supplied pduType and holding a calloc-zeroed resultCode of 0, executes rdstls_process_capabilities() which returns success without setting resultCode, causing the server to respond with an AUTHRSP message carrying RDSTLS_RESULT_SUCCESS. The attacker receives a fully authenticated RDP session having provided no valid password, redirection GUID, or auto-reconnect cookie; no public exploit code has been identified at time of analysis, but the mechanism requires only the ability to craft a standard RDSTLS PDU with a mis-typed pduType field.