CVE-2026-67293
Received Received - Intake

Improper Certificate Hostname Validation in FreeRDP

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67293
EUVD
EUVD-2026-51860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a flaw where the TLS hostname validation incorrectly matches wildcard certificates for multi-label subdomains. For example, a certificate for *.example.com would be treated as valid for a.b.example.com, which is not secure. This weakens server authentication during TLS connections.

Impact Analysis

This vulnerability could allow attackers to impersonate legitimate servers by exploiting weak wildcard certificate validation. Users might unknowingly connect to malicious servers, risking data interception or unauthorized access to sensitive information.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strong TLS authentication, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Weak server authentication could lead to unauthorized data exposure.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later to address the improper certificate hostname validation issue. Review wildcard certificates in use and ensure they comply with stricter hostname validation standards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart