Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck
CVE-2026-66402FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
Critical 9.8
In plain English
A critical-severity improper certificate validation in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-66402 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-66402 |
| Debian:14 | freerdp3 | 3.29.0+dfsg-1 | DEBIAN-CVE-2026-66402 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-66402 |
| Ubuntu:24.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-66402 |
| Ubuntu:26.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-66402 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-43hh-p3vw-hfx3) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass third-party-advisory