CVE-2026-121392: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate

Q: What must an attacker be able to do to exploit this issue?

The attacker must be able to act as a man in the middle of the RDP connection and present a certificate issued by a certificate authority trusted by the client. Exploitation depends on the certificate having a non-matching SAN while benefiting from Common Name fallback or IP-literal-to-DNS matching behavior.

Q: Which connections are exposed?

RDP sessions made with affected FreeRDP versions are exposed when the client relies on the vulnerable server certificate identity validation. The issue affects FreeRDP before version 3.32.2, including the listed Debian freerdp2 and freerdp3 packages.

Q: What could an attacker obtain or change during a successful interception?

A successful man-in-the-middle attacker can intercept RDP session content, including keystrokes, clipboard data, and screen content. The reported impact includes compromise of confidentiality and integrity, while availability is not affected.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tlsverifycertificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker must be able to act as a man in the middle of the RDP connection and present a certificate issued by a certificate authority trusted by the client. Exploitation depends on the certificate having a non-matching SAN while benefiting from Common Name fallback or IP-literal-to-DNS matching behavior.

Which connections are exposed?

RDP sessions made with affected FreeRDP versions are exposed when the client relies on the vulnerable server certificate identity validation. The issue affects FreeRDP before version 3.32.2, including the listed Debian freerdp2 and freerdp3 packages.

What could an attacker obtain or change during a successful interception?

A successful man-in-the-middle attacker can intercept RDP session content, including keystrokes, clipboard data, and screen content. The reported impact includes compromise of confidentiality and integrity, while availability is not affected.

CVE-2026-121392: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which connections are exposed?

What could an attacker obtain or change during a successful interception?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which connections are exposed?

What could an attacker obtain or change during a successful interception?