---
id: CVE-2026-66402
title: >-
  FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS
  certificate identity validation weaknesses in tls_verify_certificate(),
  tls_match_hostname(), and x509_utils_get_dns_names()
summary: >-
  FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS
  certificate identity validation weaknesses in tls_verify_certificate(),
  tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs
  custom Commo…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-295
published: '2026-08-01'
updated: '2026-08-01'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66402'
references:
  - url: >-
      https://github.com/FreeRDP/FreeRDP/commit/b9533f07f98c25ed01c5f543b4d0ce73e120f5fd
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-identity-validation-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-02T05:17:49.356Z'
epss: 0.00504
epssPercentile: 0.40413
---

## Overview

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.