REDHAT-BUG-2533925: FreeRDP FreeRDP Server vulnerability

Q: Who can exploit this issue?

An unauthenticated attacker that can reach the FreeRDP server's RDP protocol negotiation endpoint can attempt exploitation. The issue affects FreeRDP Server versions before 3.31.0 when server policy is intended to disable RDSTLS connections.

Q: What does an attacker need to do to bypass the policy?

The attacker sends incompatible protocol requests to trigger negotiation failures, then completes a TLS handshake and enters RDSTLS. This bypasses the server's pre-authentication transport restriction without requiring authentication.

Q: How can I determine whether my server is affected?

Verify whether the deployed FreeRDP Server version is earlier than 3.31.0 and whether its policy disables RDSTLS. Systems meeting both conditions should be treated as affected.

Q: What should be done if immediate patching is not possible?

The provided information does not identify a configuration workaround. Restrict network access to the FreeRDP server's RDP negotiation endpoint to trusted clients until an update to 3.31.0 or later can be deployed.

Published Sep 15, 2026

Updated

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Affected Software

1 affected component

FreeRDP FreeRDP Server<3.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP server to a version that resolves this vulnerability.
Fixed in 3.31.0

Event History

Sep 15, 2026

Data Sourced

via Red Hat·03:51 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker that can reach the FreeRDP server's RDP protocol negotiation endpoint can attempt exploitation. The issue affects FreeRDP Server versions before 3.31.0 when server policy is intended to disable RDSTLS connections.

What does an attacker need to do to bypass the policy?

The attacker sends incompatible protocol requests to trigger negotiation failures, then completes a TLS handshake and enters RDSTLS. This bypasses the server's pre-authentication transport restriction without requiring authentication.

How can I determine whether my server is affected?

Verify whether the deployed FreeRDP Server version is earlier than 3.31.0 and whether its policy disables RDSTLS. Systems meeting both conditions should be treated as affected.

What should be done if immediate patching is not possible?

The provided information does not identify a configuration workaround. Restrict network access to the FreeRDP server's RDP negotiation endpoint to trusted clients until an update to 3.31.0 or later can be deployed.

REDHAT-BUG-2533925: FreeRDP FreeRDP Server vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to bypass the policy?

How can I determine whether my server is affected?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to bypass the policy?

How can I determine whether my server is affected?

What should be done if immediate patching is not possible?