Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
Published: 2026-08-01
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in FreeRDP's TLS hostname matcher incorrectly accepts wildcard certificates that have more than one subdomain label, such as a.b.example.com, when the certificate pattern is \*.example.com. This weakens the authenticity of the TLS connection and allows a malicious server to impersonate a legitimate host, facilitating man‑in‑the‑middle attacks or credential theft.

Affected Systems

The vulnerability affects the FreeRDP client on all releases up to and including 3.28.0. Users running those outdated versions are exposed regardless of the operating system used to run the client.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity threat. Although EPSS data is currently unavailable, the absence from the CISA KEV database does not diminish the risk of exploitation. The flaw is exploitable over an open network by presenting a server with a wildcard certificate that matches a subdomain the client is expected to trust. It falls under CWE‑295, reflecting a failure to properly validate certificates.

Generated by OpenCVE AI on August 2, 2026 at 03:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.29.0 or later, which contains a corrected wildcard hostname verification routine.
  • If an upgrade cannot be performed immediately, reconfigure the client to reject certificates that contain multi‑label wildcard patterns or modify tls_match_hostname to enforce stricter matching.
  • Replace any wildcard certificates used on internal or public servers with single‑label wildcards or unique hostnames, ensuring that only subdomains directly matching the certificate are allowed.
  • Regularly review connection logs for TLS warnings or errors that indicate certificate mismatches, and investigate any anomalous attempts to connect to the client.

Generated by OpenCVE AI on August 2, 2026 at 03:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 01 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.
Title FreeRDP before 3.29.0 Improper Certificate Hostname Validation
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-295
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-05T13:40:21.301Z

Reserved: 2026-07-29T13:01:57.547Z

Link: CVE-2026-67293

cve-icon Vulnrichment

Updated: 2026-08-03T19:33:46.547Z

cve-icon NVD

Status : Received

Published: 2026-08-01T13:16:58.380

Modified: 2026-08-05T14:17:09.497

Link: CVE-2026-67293

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-01T12:22:16Z

Links: CVE-2026-67293 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T03:30:14Z

Weaknesses
  • CWE-295

    Improper Certificate Validation