CVE-2026-66402: FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_uti

criticalCVSS 9.8CVE-2026-66402

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-08-01
Last updated: 2026-08-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-66402

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-664020.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-66402	coverage & exploitation status	NVD · CVE.org

Recent advisories for FreeRDP

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] FreeRDP: Multiple vulnerabilitiescert-bund · 2026-08-05
high[UPDATE] [high] FreeRDP: Multiple vulnerabilities allow DoS and code executioncert-bund · 2026-08-05
medium[UPDATE] [mittel] Red Hat Enterprise Linux (FreeRDP): Mehrere Schwachstellencert-bund · 2026-08-05
high[NEW] [high] FreeRDP: Vulnerability allows code executioncert-bund · 2026-08-03
high[NEW] [high] FreeRDP: Multiple vulnerabilitiescert-bund · 2026-08-03
highCVE-2026-68580: FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection…nvd · 2026-08-02

CVE-2026-66402: FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_uti

Details

Exploitation outlook

Referenced CVEs

Recent advisories for FreeRDP

More from NVD Recent CVEs