CVE-2026-114047Medium· 6.8▾ SunlitFreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.
FreeRDP >= 2.0.0 < 3.32.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67294Medium· 5.9FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication
CVE-2026-67293Medium· 4.2FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability
CVE-2026-66402Critical· 9.8FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names()
CVE-2026-114041Medium· 6.5FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
CVE-2026-114046Medium· 6.5FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
CVE-2026-114044Medium· 5.3FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline