CVE-2026-91949Critical· 9.3▾ MidnightFreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protoco…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.6%
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
freerdp >= 3.0.0, < 3.31.0Upgrade past the affected range:
freerdp 3.31.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55193High· 8.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-114041Medium· 6.5FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
CVE-2026-114042Medium· 6.5FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
CVE-2026-114046Medium· 6.5FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
CVE-2026-114044Medium· 5.3FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
CVE-2026-114045High· 8.8FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format