Executive brief
FreeRDP is a remote desktop protocol implementation used to enable secure remote access to systems. Versions before 3.31.0 contain a flaw that allows unauthenticated attackers to bypass security policies and establish unauthorized RDSTLS connections even when disabled by the server. This exposes the system to unintended protocol handlers before normal authentication mechanisms can run, creating a foothold for further attacks.
Technical details
The vulnerability is a protocol state-machine error (CWE-755, CWE-693) in FreeRDP server's RDP negotiation handler. When negotiation fails for an NLA-only server, the code incorrectly sets SelectedProtocol to a combined value (PROTOCOL_FAILED_NEGO | HYBRID_REQUIRED_BY_SERVER = 0x80000005) that coincidentally contains the PROTOCOL_RDSTLS bit (0x00000004). Subsequent dispatch logic checks SelectedProtocol using bitwise AND without first verifying the failure state, causing the code to invoke RDSTLS handlers despite negotiation failure. An unauthenticated attacker can send an incompatible protocol request, receive an explicit RDP_NEG_FAILURE response, then send a TLS ClientHello on the same connection and enter RDSTLS state. Neither the RDSTLS dispatcher nor constructor validates that RDSTLS was actually enabled or requested. The vulnerability affects FreeRDP 3.0.0 through 3.30.0 and is patched in 3.31.0.
Affected products
- FreeRDP FreeRDP 3.0.0 through 3.30.0
Timeline
- 2026-09-15: disclosed
- 2026-09-01: patched: Fix released in version 3.31.0