{
  "cveId": "CVE-2026-72746",
  "url": "https://patchblox.com/security/cve/CVE-2026-72746",
  "summary": "CVE-2026-72746 is fixed in 12 products on 1 platform, first by DEBIAN-CVE-2026-72746, released August 13, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "freerdp3: FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake",
  "description": "FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTLS_RESULT_SUCCESS). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU; rdstls_process_capabilities() returns success without ever setting resultCode, so the server responds with an AUTHRSP carrying resultCode SUCCESS and treats the session as authenticated without evaluating any password, redirection GUID, or auto-reconnect cookie. This affects the released FreeRDP 3.x series (e.g., 3.27.1) and master HEAD; at the time of the advisory no patched version was available.",
  "published": "2026-08-11T13:19:05Z",
  "severity": "important",
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "freerdp",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-devel",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-libs",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-server",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp-server-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "freerdp3",
      "release": "Debian 14",
      "fixedVersion": "3.30.0\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-72746",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72746",
      "released": "2026-08-13T22:19:30Z"
    },
    {
      "platform": "linux",
      "product": "libwinpr",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libwinpr-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libwinpr-devel",
      "release": "amzn 2023",
      "fixedVersion": "2:3.6.3-1.amzn2023.0.15",
      "fix": "ALAS2023-2026-2111",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2111",
      "released": "2026-08-31T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}