Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121392FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
High 7.4
In plain English
A high-severity improper certificate validation in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-121392 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-121392 |
| Debian:14 | freerdp3 | 3.32.2+dfsg-1 | DEBIAN-CVE-2026-121392 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-121392 |
| Ubuntu:24.04:LTS | freerdp3 | no fix listed | UBUNTU-CVE-2026-121392 |
| Ubuntu:26.04:LTS | freerdp3 | no fix listed | UBUNTU-CVE-2026-121392 |
| Ubuntu:26.10 | freerdp3 | no fix listed | UBUNTU-CVE-2026-121392 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N