FreeRDP CVE-2026-73241

Exploitation requires the target to be running FreeRDP in server mode - not client mode, which represents the majority of FreeRDP deployments - with the RDSTLS authentication path active. RDSTLS is used specifically for connection redirection and session resumption, so it must be exercised in the server's configuration for the vulnerable code in rdstls_server_authenticate to be reachable. The attacker must have network access to the RDP listener port (typically TCP 3389) and must be able to establish a TLS-protected connection and initiate the RDSTLS handshake sequence. No credentials, existing session, or user interaction are required. Exploitation is bounded by the AT:P precondition: the attacker must reach the specific handshake state where rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ before sending the substituted RDSTLS_TYPE_CAPABILITIES PDU. Standard FreeRDP client-only deployments are entirely unaffected.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N) accurately characterizes a high-severity, network-exploitable authentication bypass. The AT:P (attack preconditions present) modifier is the key moderating factor: exploitation requires the target to be running FreeRDP in server mode with RDSTLS active, which constrains exposure since the large majority of FreeRDP deployments operate as clients. No EPSS score was provided, preventing probabilistic comparison to the CVSS signal. No CISA KEV listing exists, and no public exploit code has been identified, meaning there is no confirmed evidence of in-the-wild exploitation at time of analysis. Despite this, real-world risk for affected server deployments is genuine: the bypass is mechanically simple - it requires only sending a wrong PDU type at the right handshake moment - and the confidentiality impact is high since it grants unauthorized session access without credentials. Organizations deploying FreeRDP-based RDP servers in internet-exposed or multi-tenant environments should treat this as a priority given the trivial exploitation path, even absent confirmed exploitation.

An unauthenticated remote attacker connects to a FreeRDP RDP server on the standard RDP port and initiates the RDSTLS handshake. At the point where the server's rdstls_server_authenticate is waiting for an RDSTLS_TYPE_AUTHREQ PDU containing credentials, the attacker instead sends an RDSTLS_TYPE_CAPABILITIES PDU; lacking state-machine validation, the server processes it without error and returns with resultCode still at RDSTLS_RESULT_SUCCESS, granting the attacker an authenticated session context without any credential verification. No public exploit code has been identified, but the attack requires only knowledge of RDSTLS PDU type values and correct sequencing within the TLS-protected channel.