FreeRDP versions before 3.32.2 contain an improper certificate validation flaw in the tls_verify_certificate() function. The routine incorrectly accepts a Common Name fallback even when the Subject Alternative Name entries do not match, and it matches IP literals against DNS strings. This allows an attacker who can present a certificate issued by a client‑trusted Certificate Authority to bypass all server identity checks. As a result, the attacker can perform a man‑in‑the‑middle attack on any Remote Desktop Protocol session, capturing keystrokes, clipboard data, and screen contents, effectively gaining full control of the victim’s session.

All installations of FreeRDP older than version 3.32.2 are vulnerable. The affected product is the open‑source RDP client and server implementation, FreeRDP, on any platform that compiles or runs the affected version.

The CVSS score of 9.1 classifies this flaw as critical. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the severity remains high. The attack requires an active network connection from the victim’s RDP client to an attacker who supplies a forged certificate from a client‑trusted CA. Once the client connects, the server identity checks are bypassed and the attacker can intercept, relay, and observe the entire RDP session.