CVE-2026-109952 FreeRDP CVE debrief

Who should care

System administrators and security professionals responsible for remote access configurations and FreeRDP client deployments should assess exposure and prioritize remediation. This includes reviewing current FreeRDP client versions, understanding the security protocol downgrade vulnerability, and taking steps to verify and upgrade clients as necessary. Additionally, defenders should focus on monitoring authentication attempts and reviewing remote access A

Why it matters

CVE-2026-109952 is a security protocol downgrade vulnerability in FreeRDP client versions 3.0.0 before 3.32.0. This issue allows a malicious server or man-in-the-middle to potentially override security settings and obtain cleartext passwords. Defenders should verify and upgrade FreeRDP clients, review remote access configurations, and monitor authentication attempts.

• Potential exposure of cleartext passwords
• Bypass of security protocols like /sec:nla pinning
• Authentication downgrade to an insecure protocol
• Verification of FreeRDP client version and configuration

Technical summary

The FreeRDP client versions 3.0.0 before 3.32.0 do not properly check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(). This oversight allows for a security protocol downgrade, potentially enabling a malicious server or man-in-the-middle to override /sec:nla pinning and complete authentication with an all-zero cookie, thereby obtaining the user's cleartext password in the Client Info PDU.

Defensive priority

Defenders should prioritize verifying and upgrading FreeRDP clients to version 3.32.0 or later, especially in environments where remote access is common.

Recommended defensive actions

• Verify and upgrade FreeRDP clients to version 3.32.0 or later
• Implement additional monitoring for authentication attempts
• Review and update remote access configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in FreeRDP client versions 3.0.0 before 3.32.0. Official sources, including the CVE Program and NVD, provide details on this vulnerability. Defenders should verify FreeRDP client versions, review remote access configurations, and monitor authentication attempts for potential exposure. The CVE Program and NVD detail pages offer specific information on affected versions and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.