Improper handling of exceptional conditions in FreeRDP - CVE-2026-91949

Vulnerability identifier: #VU146580

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-91949

CWE-ID: CWE-755

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass the configured transport security policy and disclose sensitive information.

The vulnerability exists due to improper handling of exceptional conditions in rdp_server_accept_nego() and protocol selection logic when processing an RDP negotiation failure followed by continued connection handling. A remote attacker can send an incompatible negotiation request and then continue the same connection to enter unintended RDSTLS processing to bypass the configured transport security policy and disclose sensitive information.

The issue is pre-authentication and can expose RDSTLS capabilities and related server-side parsers before the configured authentication mechanism runs.

FreeRDP
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
freerdp (Red Hat package)

Install security update from vendor's website.

FreeRDP - update to 3.31.0
freerdp (Red Hat package) - addressed in versions 3.10.3-3.el10_0.18, 3.10.3-12.el10_2.13

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6

• Multiple vulnerabilities in FreeRDP
• Red Hat Enterprise Linux 10 update for freerdp
• Red Hat Enterprise Linux 10 update for freerdp