Insufficiently protected credentials in FreeRDP - #VU164455
Published: November 10, 2026
Vulnerability identifier: #VU164455
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-522
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain a configured reusable client password intended to be withheld by Remote Credential Guard.
The vulnerability exists due to insufficient credential protection in FreeRDP's Client Info writer when handling Remote Credential Guard connections, with separate negotiation validation weaknesses permitting a downgrade to the same disclosure path. A remote attacker can entice a victim with a configured /p password to connect to a controlled server and receive that password after Kerberos/CredSSP or through selection of an unoffered classic RDP protocol.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.33.0