FreeRDP EUVD-2026-98656

Exploitation requires the attacker to control or intercept the RDP server side of the connection - either operating a malicious RDP server the victim connects to, or holding a man-in-the-middle position on the network path (reflected by AT:P). The victim must actively initiate an RDP session using a vulnerable FreeRDP client build (3.0.0 through 3.31.x), and the flaw specifically defeats clients relying on /sec:nla protocol pinning by letting the server select PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX without the client checking it against its enabled protocol set in nego_process_negotiation_response(). Limiting factors: the required privileged network position, the need for user-initiated connection (UI:P), and that only confidentiality (the submitted password) is at risk - there is no code execution, integrity, or availability impact. Updating to FreeRDP 3.32.0 removes the condition.

This is a moderate-risk credential-disclosure flaw, not a drop-everything priority. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, score 6.0) and CWE-757 (algorithm downgrade) align well with the description: an attacker needs a privileged network position (malicious server or man-in-the-middle, reflected by AT:P) and the victim must initiate an RDP session (UI:P), but no credentials are required (PR:N) and the payoff is high confidentiality impact (VC:H) - the user's cleartext password - with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The AT:P attack requirement is the key moderating signal: successful exploitation depends on the attacker already being able to impersonate or intercept the server, which makes this far more useful for targeted interception than for opportunistic mass exploitation. One point to verify: AV:N correctly captures that the attack crosses the network, but it does NOT mean a remote attacker with no positioning can trigger it - a MITM or rogue-server foothold is required.

An attacker positioned as a man-in-the-middle (e.g., on a shared or compromised network) intercepts a user's RDP connection to a server the user expects to authenticate via NLA. Because the FreeRDP client (3.0.0-3.31.x) fails to validate the server-selected security protocol against its enabled set, the attacker's response selects PROTOCOL_RDSTLS, downgrading the session despite /sec:nla pinning, completes authentication with an all-zero cookie, and harvests the victim's cleartext password from the Client Info PDU. No public exploit code was identified in the provided data.