{"id":"CVE-2026-121392","kind":"vulnerability","aliases":["CVE-2026-121392"],"related":[],"title":"FreeRDP: certificate check accepts wrong server names, enabling interception of RDP sessions","description":"FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.","summary":"FreeRDP before 3.32.2 wrongly accepts a server certificate whose Common Name is used despite non-matching Subject Alternative Names, and matches IP addresses against DNS names. An attacker holding a certificate from a CA the client trusts can man-in-the-middle RDP sessions and read keystrokes, clipboard and screen content.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","package","rdp","remote-desktop"],"not_affected_if":["freerdp-3.32.2-or-later","no-rdp-clients"],"how_to_check":"- Check the FreeRDP version in use with `xfreerdp /version` or the package manager, and compare against `3.32.2`.\n- Look for FreeRDP builds or embedded copies in remote-desktop clients and applications that link the library.","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-03T15:17:26+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","triaged_at":"2026-11-03T15:22:35+00:00","updated_at":"2026-11-03T15:22:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:22:35Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: certificate check accepts wrong server names, enabling interception of RDP sessions","impact":"high","summary":"FreeRDP before 3.32.2 wrongly accepts a server certificate whose Common Name is used despite non-matching Subject Alternative Names, and matches IP addresses against DNS names. An attacker holding a certificate from a CA the client trusts can man-in-the-middle RDP sessions and read keystrokes, clipboard and screen content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","rdp","remote-desktop"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads keystrokes, clipboard and screen during RDP sessions","analyst_note":"","how_to_check":"- Check the FreeRDP version in use with `xfreerdp /version` or the package manager, and compare against `3.32.2`.\n- Look for FreeRDP builds or embedded copies in remote-desktop clients and applications that link the library.","plain_action":"","needs_analyst":false,"not_affected_if":["freerdp-3.32.2-or-later","no-rdp-clients"],"who_is_affected":"Clients that connect to RDP servers with FreeRDP before 3.32.2 are exposed, including applications that embed the library. The risk depends on an attacker being able to sit on the network path and hold a certificate from a CA the client trusts. Teams that use only other RDP clients or stay on 3.32.2 or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4209,"output_tokens":599,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-121392':15A,18A '-2026':14A,17A '3.32.2':27B,80C 'accept':4A,29B,92C 'address':48B 'altern':43B 'attack':53B,114C 'bypass':125C 'ca':59B,123C 'certif':2A,32B,56B,84C,90C,117C 'check':3A,128C 'client':61B,121C 'client-trust':120C 'clipboard':74B,135C 'common':34B,93C 'contain':81C 'content':77B,138C 'cve':13A,16A 'desktop':24B 'despit':38B,96C 'dns':50B,107C 'enabl':8A 'entri':101C 'fallback':95C 'freerdp':1A,19B,25B,78C 'hold':54B,115C 'ident':127C 'improp':83C 'includ':133C 'intercept':9A,130C 'ip':47B,104C 'keystrok':73B,134C 'liter':105C 'man':65B,110C 'man-in-the-middl':64B,109C 'match':41B,46B,99C,103C 'middl':68B,113C 'name':7A,35B,44B,51B,94C 'non':40B,98C 'non-match':39B,97C 'packag':20B 'rdp':11A,21B,69B,131C 'read':72B 'remot':23B 'remote-desktop':22B 'san':100C 'screen':76B,137C 'server':6A,31B,126C 'session':12A,70B,132C 'string':108C 'subject':42B 'tls':88C 'trust':62B,122C 'use':37B 'valid':85C 'verifi':89C 'vulner':86C 'whose':33B 'wrong':5A,28B","nicknames":[],"mitigations":[],"who_affected":"Clients that connect to RDP servers with FreeRDP before 3.32.2 are exposed, including applications that embed the library. The risk depends on an attacker being able to sit on the network path and hold a certificate from a CA the client trusts. Teams that use only other RDP clients or stay on 3.32.2 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","freerdp","package","rdp","remotedesktop"],"first_public_at":"2026-10-19T12:13:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121392","severity":null,"published_at":"2026-11-03T15:17:26+00:00","modified_at":"2026-11-03T15:17:26+00:00","first_seen_at":"2026-11-03T15:21:57+00:00","fetched_at":"2026-11-03T15:21:57+00:00","note":null}],"documents":[{"id":58307,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:13:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58308,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}