CVE-2026-66402: Freerdp vulnerability (CVSS 9.8)

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Freerdp< 3.29.0

Remediation

Fixed in

Freerdp≥ 3.29.0

Patch & vendor advisories

References

https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fdPatch
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3Vendor AdvisoryExploitMitigation
https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypassPatchThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-66402 being actively exploited?

CVE-2026-66402 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.51%.

How severe is CVE-2026-66402?

CVE-2026-66402 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.51% probability of exploitation.

Which products are affected by CVE-2026-66402?

Affected products include Freerdp.

How do I fix CVE-2026-66402?

Upgrade affected software to a fixed version, for example Freerdp 3.29.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-66402 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo