Do Son 
TL;DR
FreeRDP 3.31.0 patches five server-role flaws reported by Bynario, plus 17 other issues. Researchers chained three of them into pre-authentication remote code execution. This FreeRDP vulnerability set affects server projects like GNOME Remote Desktop and KDE krdp, though full-chain exposure stays narrow.
Why It Matters
FreeRDP is a widely used open-source implementation of the Remote Desktop Protocol. Many Linux remote desktop tools embed it as their RDP server. Therefore, a server-role FreeRDP vulnerability reaches software far beyond the project itself.
Client-role FreeRDP stays safe from all five issues. Only machines set up as RDP servers face risk. Even then, an admin must enable an affected remote desktop service.
Note on Identifiers
The five advisories carry GitHub GHSA identifiers. As of writing, CVE numbers are not yet assigned in the release notes. This report therefore tracks them by their GHSA IDs.
How the Attack Works
The most severe flaw is an authentication bypass, GHSA-x7v6-xfx3-52j6, rated 9.3. A server rejects the client’s protocol offer but keeps the socket open. It then reads the failure code as a protocol choice. As a result, an unauthenticated peer enters a security mechanism the server disabled.
Two more flaws complete the demonstrated chain. GHSA-r7jx-j9h7-j4xj leaks stale heap memory through a graphics reset. GHSA-9jcm-x588-gh26 then writes eight attacker-controlled bytes onto a live object. Together, they reach remote code execution before login.
Two remaining issues, a use-after-free and a smartcard buffer flaw, mainly cause denial of service. This report withholds exploit details.
Exploitation Status
Bynario demonstrated the chain in a lab setting. However, no exploitation in the wild has been confirmed. The researchers also stress that full-chain exposure is limited.
The complete chain hits only bleeding-edge builds using GNOME Remote Desktop 51 pre-release in Remote Login mode. That said, the authentication bypass alone covers many systems, including Ubuntu 24.04 LTS and later.
Affected Versions
The bypass affects FreeRDP 3.0.0-beta1 through 3.30.0. The heap leak and use-after-free span the 3.x line through 3.30.0. The other two flaws affect 3.28.0, 3.29.0, and 3.30.0 only.
Patch and Mitigation Steps
Upgrade to FreeRDP 3.31.0 without delay. You can review the fixes in the official FreeRDP 3.31.0 release notes. There is no 3.30.x point release, so distributions on 3.30.0 or earlier need the 3.31.0 rebase or their own backports. Until you patch, limit RDP server exposure to trusted networks.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
