CVE-2026-109952: FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in negoprocessnegotiationresponse(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to password disclosure?
FreeRDP client versions from 3.0.0 through versions before 3.32.0 are affected. Exposure exists when a user connects to a malicious server or when an attacker can act as a man-in-the-middle during the connection.
Does configuring /sec:nla prevent this downgrade?
No. A malicious negotiation response can select RDSTLS despite /sec:nla pinning, allowing authentication to complete and causing the client to send the user's cleartext password in the Client Info PDU.
What must an attacker be able to do?
The attacker must either operate the RDP server the user connects to or intercept and modify the protocol negotiation response as a man-in-the-middle. User interaction is required because the user must initiate a connection.
What should be done when immediate upgrading is not possible?
The provided information does not identify a configuration workaround. Until updating to 3.32.0 or later, avoid connections to untrusted RDP servers and reduce opportunities for man-in-the-middle interception.