T
Threats
FreeRDP Improper Certificate Validation Vulnerability
Overview
CVE: CVE-2026-121392 (as supplied with the project; not confirmed by the vendor advisory, see Research Gaps)
Severity: High (vendor-published CVSS 7.4)
Date: 4 November 2026
FreeRDP has published a security advisory for an improper certificate validation flaw affecting FreeRDP 3.32.1 and earlier. An attacker who holds a certificate issued by a CA the client already trusts can bypass server identity checks and intercept RDP sessions, including keystrokes, clipboard and screen content. FreeRDP 3.32.2 addresses the issue.
Affected Versions
Affected: FreeRDP 3.32.1 and earlier (<= 3.32.1)
Fixed: FreeRDP 3.32.2
Not affected: Not stated by the vendor
Vulnerability Breakdown
CVE-2026-121392 - Improper Certificate Validation (CWE-295)
Severity: High
CVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), as published in the FreeRDP Security Advisory GHSA-jq25-3374-4262
Description: The tls_verify_certificate() function in libfreerdp/crypto/tls.c accepts a Common Name match even when the certificate's Subject Alternative Name (SAN) entries do not match the target host. When the target is an IP address, FreeRDP also matches it as a plain string against CN and DNS SAN entries instead of checking a true iPAddress SAN. The advisory describes this as an incomplete fix for GHSA-43hh-p3vw-hfx3.
Impact: Silent bypass of server identity verification, allowing session interception. The attacker can view screen content, keystrokes and clipboard data, and inject input.
Conditions: The attacker must be positioned to intercept the RDP connection and must present a certificate that chains to a CA already trusted by the FreeRDP client (for example through misissuance or a rogue or compromised CA). No code execution or credential extraction is claimed.
Notes: The vendor advisory rates this issue High (7.4). The project brief listed it as Critical (9.1). The vendor rating has been used here.
Mitigation
Upgrade FreeRDP to version 3.32.2 or later, as stated in the FreeRDP Security Advisory GHSA-jq25-3374-4262 and the FreeRDP 3.32.2 Release Notes.
The vendor has not published a workaround for this issue.
Identify applications and appliances that bundle or link FreeRDP (libfreerdp) and confirm their version with the relevant supplier.
Summary for IT Teams
Products: FreeRDP FreeRDP
Threat Level: High, CVSS 7.4
Action Required: Upgrade FreeRDP to 3.32.2 or later, and check any third-party software that embeds FreeRDP.
Research Gaps
CVE ID not confirmed: The vendor advisory GHSA-jq25-3374-4262 does not list a CVE ID, and the supplied CVE Record: CVE-2026-121392 returned no readable content. The ID CVE-2026-121392 is unverified.
Severity conflict: The project brief states Critical, CVSS 9.1. The vendor advisory states High, CVSS 7.4. Confirm which rating to publish.
Reference
Need Help?
If your organisation needs assistance assessing or patching FreeRDP, the Secure ISS SOC team is ready to help. Please get in touch on 1300 769 460 or email us. We are here to help you strengthen your cybersecurity posture.
