FreeRDP TLS Certificate Validation Bypass — CVE-2026-66402

"FreeRDP versions at or below 3.28.0 mishandle TLS certificate identity checks, letting a network-positioned attacker with a trusted or misissued certificate impersonate an RDP server."

FreeRDP versions at or below 3.28.0 mishandle TLS certificate identity checks, letting a network-positioned attacker with a trusted or misissued certificate impersonate an RDP server.

What Is It

CVE-2026-66402 is a set of TLS certificate identity validation weaknesses (CWE-295) in FreeRDP's tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names() functions. Rather than using OpenSSL's length-aware identity validation APIs, FreeRDP implements its own Common Name and DNS SAN string matching. That custom logic fails three ways:

NUL truncation: DNS SAN values are cut at embedded NUL bytes, so victim.example\0.attacker.example is accepted as victim.example.
CN fallback: a matching Common Name is accepted even when non-matching DNS SAN entries are present.
IP-literal mismatch: IP-literal targets are accepted via DNS/CN matching without comparing iPAddress SANs.

The record was published 2026-08-01 by VulnCheck and is currently in "Received" status at NVD.

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the CVSS 4.0 score is 9.3 (CRITICAL). The flaw is remotely reachable, requires no privileges and no user interaction, and carries high confidentiality, integrity, and availability impact. An attacker positioned to present a trusted or misissued certificate chain can bypass server identity verification, defeating TLS server authentication for the RDP session.

There is no CISA KEV entry for this CVE, the supplied KEV data is empty, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time.

What's Vulnerable

Vendor/product: FreeRDP (FreeRDP)
Affected: all versions below 3.29.0 (explicitly <= 3.28.0)
Unaffected: 3.29.0 and later

No CPE entries were listed in the NVD record.

Patch Status

Fixed in FreeRDP 3.29.0. Upgrade to 3.29.0 or later. The fix is tracked in commit b9533f07f98c25ed01c5f543b4d0ce73e120f5fd and GitHub Security Advisory GHSA-43hh-p3vw-hfx3. No workaround is described in the supplied source material.

Sources

NVD, CVE-2026-66402 record (source: [email protected]), published 2026-08-01
FreeRDP GitHub Security Advisory GHSA-43hh-p3vw-hfx3; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3
FreeRDP fix commit; https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd
VulnCheck advisory; https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass