Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-121392: FreeRDP before 3.32.2 allows fake server certificate
CVE-2026-121392 · published 2 days ago
Summary
The FreeRDP remote‑desktop client versions older than 3.32.2 do not properly check the server's security certificate. An attacker who can present a trusted certificate could pretend to be the remote computer and see everything you type, copy, or view. Update FreeRDP to version 3.32.2 or later, or apply any available patches, to ensure proper certificate verification.
What to do
- Update debian freerdp3 to version 3.32.2+dfsg-1.
- Update freerdp freerdp to version 3.32.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | freerdp | freerdp | < 3.32.2 |
| Debian:12 | debian | freerdp2 | All versions |
| Debian:13 | debian | freerdp3 | All versions |
| Debian:14 | debian | freerdp3 |
< 3.32.2+dfsg-1 Fix: upgrade to 3.32.2+dfsg-1
|
| Ubuntu:16.04:LTS | canonical | freerdp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | freerdp2 | All versions |
| Ubuntu:24.04:LTS | canonical | freerdp3 | All versions |
Original advisory text
FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262 Third Party Advisory
- https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-1213... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-121392 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-121392 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-121392 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-121392 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-295Improper Certificate Validation
Timeline
Published3 Nov 2026
Updated5 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-121392 · NVD
CVE-2026-121392 · MITRE
CVE-2026-121392 · OSV
GHSA-jq25-3374-4262 · GHSA
DEBIAN-CVE-2026-121392 · OSV
UBUNTU-CVE-2026-121392 · OSV
Track software like this
Free during beta