EUVD-2026-78806
GHSA-hcpv-8ff6-4xx8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated protocol bypass (AV:N/AC:L/PR:N), but the concrete effect is defeating an admin transport policy, so C:L/I:L and no availability impact rather than full high triad.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
AnalysisAI
Unauthenticated remote attackers can bypass the RDSTLS-disabling policy on FreeRDP servers 3.0.0 through 3.30.0 by sending incompatible protocol requests that produce a negotiation failure, then completing a TLS handshake and entering RDSTLS anyway, defeating the intended pre-authentication transport restriction. The vendor CVSS 4.0 base score is 9.2, but our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting a policy bypass with limited confidentiality and integrity impact rather than direct code execution; no public exploit was identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a FreeRDP instance running in server mode (versions 3.0.0 through 3.30.0) that is reachable over the network AND configured with server policy that disables RDSTLS - the flaw specifically defeats that disabling policy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 base score of 9.2 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N with subsequent-system SC:H/SI:L) rates this critical, driven by network reachability, no authentication, and asserted high confidentiality impact on both the vulnerable system and a subsequent system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade FreeRDP server deployments to version 3.31.0 or later, the vendor-released patch that corrects the protocol negotiation bypass (see https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FreeRDP deployments to identify server-mode instances running versions 3.0.0 through 3.30.0 where RDSTLS has been administratively disabled, and confirm whether any are reachable from untrusted networks; restrict network access to those listeners at the firewall or load balancer where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and
FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today