CVE-2026-91949

Name	CVE-2026-91949
Description	FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
freerdp2 (PTS)	bookworm	2.11.7+dfsg1-6~deb12u1	fixed
freerdp3 (PTS)	trixie	3.15.0+dfsg-2.1+deb13u3	vulnerable
	forky, sid	3.32.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
freerdp2	source	(unstable)	(not affected)
freerdp3	source	(unstable)	3.31.0+dfsg-1

Notes

- freerdp2 <not-affected> (Only affects 3.0 and later)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
https://www.openwall.com/lists/oss-security/2026/09/01/2