PT-2026-67265 · Freerdp · Freerdp

1121984919 · CVE-2026-66402 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description Weaknesses in TLS certificate identity validation occur within the tls verify certificate(), tls match hostname(), and x509 utils get dns names() functions. The software uses custom Common Name and DNS SAN string matching instead of OpenSSL's length-aware identity validation APIs. This leads to three issues: DNS SAN values are truncated at embedded NUL bytes, a matching Common Name is accepted even if non-matching DNS SAN entries exist, and IP-literal targets are accepted via DNS/CN matching without comparing iPAddress SANs. An attacker with a trusted or misissued certificate chain can bypass server identity verification, compromising TLS server authentication.

Recommendations Update to version 3.29.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-66402

GHSA-43HH-P3VW-HFX3

Affected Products

Freerdp

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66402.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3 · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-66402 · Security Note
• https://osv.dev/vulnerability/CVE-2026-66402 · Vendor Advisory
• https://vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass · Note