CVE-2026-67293
CRITICAL
CVSS 9.3
freerdp
Verified Advisory
Improper wildcard certificate hostname validation in FreeRDP (CVE-2026-67293)
FreeRDP's TLS hostname matcher incorrectly accepts wildcard certificates (e.g., *.example.com) for multi-label subdomains (e.g., a.b.example.com), which standard wildcard matching does not permit. This diverges from OpenSSL's X509_check_host() behavior and may weaken TLS server authentication when clients connect to multi-label hostnames under wildcard-certificate conditions.
Affected versions:
- <= 3.28.0
We recommend updating to: 3.29.0.
CVSS 9.3 · our assessment: act_now
Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f
Details: https://vuln.today/cve/CVE-2026-67293
Verified by vuln.today against published advisories.
Affected versions
- – <= 3.28.0
Fixed in: 3.29.0
More advisories for freerdp
- CVE-2026-67305 – Heap buffer overflow in FreeRDP Windows client clipboard virtual channel (CVE-2026-67305)
- CVE-2026-67294 – Certificate purpose bypass in FreeRDP server TLS authentication (CVE-2026-67294)
- CVE-2026-67292 – Buffer over-disclosure and DoS via WebSocket Ping handling in FreeRDP (CVE-2026-67292)
- CVE-2026-67289 – HTTP proxy CONNECT injection in FreeRDP via RDP redirection TargetNetAddress (CVE-2026-67289)
- CVE-2026-66402 – TLS certificate identity validation bypass in FreeRDP (CVE-2026-66402)