Security Protocol Downgrade in FreeRDP Client by FreeRDP

CVE-2026-109952

What is CVE-2026-109952?

The FreeRDP client prior to version 3.32.0 is susceptible to a vulnerability where it fails to properly validate a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its configured protocol set. This oversight can permit a malicious server or man-in-the-middle attacker to execute a security protocol downgrade, allowing the attacker to bypass /sec:nla pinning and perform authentication using an all-zero cookie. Consequently, sensitive information, including the user's cleartext password, can be extracted from the Client Info PDU.

References