https://seclists.org/oss-sec/2026/q3/633: FeRDP <= 3.30.0: five server-side vulnerabilities fixed in 3.31.0, p-auth RCE demonstrated
Affected Software
Frequently Asked Questions
Which deployments are exposed to these issues?
Exposure is limited to systems using FreeRDP in the server role, including projects that embed it as an RDP server such as GNOME Remote Desktop and KDE krdp. These services are not typically enabled by default; affected systems have generally been configured by an administrator to provide remote desktop or remote login access.
Are FreeRDP client installations affected?
No. Client-role FreeRDP is not affected by any of the five reported server-side issues.
Does exploitation require valid RDP credentials?
Issues 2 through 5 require an authenticated RDP session under normal circumstances. In remote-login modes, issue 1 can bypass authentication to establish an RDP connection that renders the login screen, and three issues were demonstrated as a pre-authentication remote-code-execution chain.
What should organizations do if they are on 3.30.0 or an earlier release?
Upgrade to FreeRDP 3.31.0, or apply distribution-provided backports. There is no 3.30.x point release containing these fixes, so deployments on 3.30.0 or earlier require a 3.31.0 rebase or their own backported fixes.