FreeRDP CVE-2026-91949

Exploitation requires a FreeRDP instance running in server mode (versions 3.0.0 through 3.30.0) that is reachable over the network AND configured with server policy that disables RDSTLS - the flaw specifically defeats that disabling policy. No authentication or user interaction is required (PR:N/UI:N). The limiting factor is that the target must actually be a FreeRDP-based RDP server with RDSTLS administratively disabled; servers that permit RDSTLS gain nothing bypassed, and pure FreeRDP client deployments (the more common use of the library) are not affected. Impact is a downgrade/bypass of the intended pre-authentication transport restriction rather than direct code execution.

The vendor CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N with subsequent-system SC:H/SI:L) rates this critical, driven by network reachability, no authentication, and asserted high confidentiality impact on both the vulnerable system and a subsequent system. That severity appears somewhat inflated for what the description actually describes: a protection-mechanism failure (CWE-693) that lets an unauthenticated client force a FreeRDP server into RDSTLS negotiation even when server policy has disabled it. This is fundamentally a policy/transport-restriction bypass, not a demonstrated data-exfiltration or code-execution primitive, so VC:H/SC:H likely overstate the direct confidentiality loss (assessed C:L/I:L). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no signal of active or automated exploitation - this reads as a real but not-yet-weaponized pre-auth hardening bypass rather than an imminently-exploited RCE. Priority is moderate-to-high for exposed FreeRDP-based servers because it is remote and unauthenticated, but the concrete impact is a downgrade of an admin-enforced transport restriction, not confirmed compromise. SSVC framework fields were not supplied in the input and cannot be reported.

An attacker who can reach a FreeRDP-based RDP server (versions 3.0.0 through 3.30.0) over the network sends an incompatible protocol negotiation request, receives the expected negotiation failure, then proceeds to complete the TLS handshake and enter RDSTLS - even though the operator configured the server to disable RDSTLS. This bypasses the intended pre-authentication transport restriction with no credentials required. No public proof-of-concept is identified in the provided data; the flaw was reported by VulnCheck.