PT-2026-111547

CVE-2026-109952

Published

2026-10-13

Updated

2026-10-16

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description The client fails to verify server-selected PROTOCOL RDSTLS or PROTOCOL HYBRID EX against the enabled protocol set within the nego process negotiation response() function. This flaw allows a security protocol downgrade, enabling a malicious server or man-in-the-middle attacker to select RDSTLS to override /sec:nla pinning. Consequently, the attacker can complete authentication using an all-zero cookie and obtain the user's cleartext password via the Client Info PDU.

Recommendations Update to version 3.32.0 or later.

Exploitability

Exploit

Fix

Researchers

Davidkorczynski

Vendors

Affected products

Weakness enumeration

CWE-757: Selection of Less-Secure Algorithm During Negotiation (\'Algorithm Downgrade\')

Related identifiers

CVE-2026-109952