PT-2026-67273 · Freerdp · Freerdp

1121984919 · CVE-2026-67293 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description An improper certificate hostname validation issue exists where the TLS hostname matcher tls match hostname() in libfreerdp/crypto/tls.c incorrectly handles wildcard patterns. Specifically, a pattern like *.example.com is treated as matching any hostname ending in .example.com, allowing wildcard certificates to be accepted for multi-label subdomains such as a.b.example.com. This behavior weakens TLS server authentication.

Recommendations Update FreeRDP to version 3.29.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-67293

GHSA-5WR6-8M8J-3H7F

Affected Products

Freerdp

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67293.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f · Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-67293 · Security Note
• https://osv.dev/vulnerability/CVE-2026-67293 · Vendor Advisory
• https://vulncheck.com/advisories/freerdp-before-improper-certificate-hostname-validation · Note