CVE-2026-73241
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
FreeRDP prior to version 3.30.0 has a vulnerability in server-side RDSTLS that accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ. This allows a remote unauthenticated client to bypass RedirectionGuid, username, domain, or password checks.
Risk Assessment
An unauthenticated attacker can bypass authentication and gain access to RDP sessions, potentially leading to unauthorized system access.
Recommendation
Update FreeRDP to version 3.30.0 or later, which fixes this vulnerability. Additionally, enable strong authentication and restrict access to RDP services.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS_TYPE_CAPABILITIES PDU while rdstls_server_authenticate is waiting for RDSTLS_TYPE_AUTHREQ, leaving resultCode at RDSTLS_RESULT_SUCCESS and allowing a remote unauthenticated client to bypass the RedirectionGuid, username, domain, or password checks. This issue is fixed in version 3.30.0.