CVE-2026-109952 Overview
CVE-2026-109952 is a security protocol downgrade vulnerability in the FreeRDP client affecting versions 3.0.0 through 3.31.x. The client fails to validate a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(). A malicious server or man-in-the-middle attacker can override /sec:nla pinning, force the client into RDSTLS, complete authentication using an all-zero cookie, and capture the user's cleartext password from the Client Info PDU. The flaw is categorized under [CWE-757] (Selection of Less-Secure Algorithm During Negotiation).
Critical Impact
Attackers positioned on the network can downgrade RDP security negotiation and recover cleartext credentials from FreeRDP users who intended to enforce Network Level Authentication.
Affected Products
- FreeRDP client 3.0.0 through 3.31.x
- Applications and distributions bundling vulnerable FreeRDP 3.x client libraries
- Remote desktop tooling built on FreeRDP (such as third-party RDP clients using libfreerdp)
Discovery Timeline
- 2026-10-13 - CVE-2026-109952 published to the National Vulnerability Database
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-109952
Vulnerability Analysis
The FreeRDP client negotiates one of several RDP security protocols with the server during the connection setup phase. Supported protocols include standard RDP security, TLS, CredSSP/NLA, RDSTLS, and HYBRID_EX. The client advertises an allowed set based on user-supplied flags such as /sec:nla, which should pin the session to Network Level Authentication.
In nego_process_negotiation_response(), the client accepts the server's selected protocol without confirming that it belongs to the enabled set. When the server responds with PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX, FreeRDP proceeds down that code path even though the user explicitly disabled it. This breaks the security guarantee of the /sec pinning options.
Once the downgrade succeeds, the RDSTLS handshake proceeds with an all-zero cookie, bypassing the credential-protection properties that NLA was intended to provide. FreeRDP then transmits the user's password in cleartext inside the Client Info PDU, exposing it to any attacker controlling the server or the network path.
Root Cause
The root cause is missing validation of the negotiated protocol against the client's configured allow-list. The function trusts the server-selected value in the negotiation response, which violates the principle that a client must enforce its own minimum security policy regardless of server behavior.
Attack Vector
Exploitation requires an attacker to either operate a malicious RDP server that the victim connects to or occupy a man-in-the-middle position on the network path. User interaction is required: the victim must initiate an RDP session. The attacker responds to the negotiation request by selecting RDSTLS, drives the handshake with an all-zero cookie, and reads the Client Info PDU to obtain the plaintext password.
For exploitation specifics and proof-of-concept details, refer to the GitHub Security Advisory GHSA-qq23-mqmv-pc65 and the VulnCheck Advisory on FreeRDP.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109952
Indicators of Compromise
- RDP sessions where the client negotiates RDSTLS or HYBRID_EX despite being launched with /sec:nla or equivalent NLA-only configuration.
- RDSTLS handshakes containing an all-zero cookie value in the authentication exchange.
- Outbound RDP connections from Linux or Unix hosts running FreeRDP 3.0.0 through 3.31.x to untrusted destinations.
Detection Strategies
- Inspect RDP negotiation response PDUs on the wire and alert when the selected protocol does not match the client's advertised policy.
- Hunt for FreeRDP binaries at versions earlier than 3.32.0 across managed hosts and developer workstations.
- Correlate RDP flows with endpoint telemetry to identify sessions terminating at non-corporate or newly observed RDP servers.
Monitoring Recommendations
- Enable packet capture or TLS inspection on segments carrying outbound RDP traffic and retain negotiation metadata.
- Alert on unexpected RDP destinations from endpoints that normally only connect to internal jump hosts.
- Track credential-use anomalies that follow outbound RDP sessions, which may indicate harvested passwords in reuse.
How to Mitigate CVE-2026-109952
Immediate Actions Required
- Upgrade FreeRDP client installations to version 3.32.0 or later across all affected systems.
- Rotate passwords for any accounts recently used over RDP from vulnerable FreeRDP clients to untrusted or external endpoints.
- Restrict outbound RDP connectivity from workstations to a known allow-list of internal RDP targets.
Patch Information
The FreeRDP project addressed the issue in version 3.32.0 by validating the server-selected protocol against the client's enabled set inside nego_process_negotiation_response(). Review the GitHub Security Advisory GHSA-qq23-mqmv-pc65 for the fix commit and supported downstream package updates.
Workarounds
- Avoid connecting FreeRDP 3.x clients earlier than 3.32.0 to RDP servers outside trusted network segments until patched.
- Route RDP traffic through an authenticated VPN or zero-trust gateway that terminates attacker-in-the-middle positions.
- Where feasible, disable use of the vulnerable client in favor of a patched build packaged by your Linux distribution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
