Live › vulnerability › CVE-2026-121392
FreeRDP before 3.32.2 wrongly accepts a server certificate whose Common Name is used despite non-matching Subject Alternative Names, and matches IP addresses against DNS names. An attacker holding a certificate from a CA the client trusts can man-in-the-middle RDP sessions and read keystrokes, clipboard and screen content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Clients that connect to RDP servers with FreeRDP before 3.32.2 are exposed, including applications that embed the library. The risk depends on an attacker being able to sit on the network path and hold a certificate from a CA the client trusts. Teams that use only other RDP clients or stay on 3.32.2 or later can skip it.
No product ranges from the sources yet.
xfreerdp /version or the package manager, and compare against 3.32.2.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
This page as .md · .json · in your agent: get_signal("CVE-2026-121392")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.