FreeRDP EUVD-2026-106998

Exploitation requires three concrete conditions: (1) FreeRDP must be deployed in PROXY mode, (2) the proxy must have NO verification module configured for validating the target's TLS certificate (the specific insecure state named in the description), and (3) the attacker must occupy a man-in-the-middle network position able to intercept the proxy's OUTBOUND connection to the RDP target. Limiting factors that reduce real-world risk: the flaw affects only the proxy's target-facing connection (not generic FreeRDP clients), the high attack complexity (AC:H) and attack requirement (AT:P) reflect the need for a privileged on-path position and a race, and UI:P means a victim RDP session must actually be proxied through the vulnerable component during the window. Deployments that configure a certificate verification module are not affected.

This is a man-in-the-middle certificate-validation flaw (CWE-295) in FreeRDP's proxy component, scored 7.6 (HIGH) via the provided CVSS 4.0 vector. The signals are mixed and point to a conditional rather than a blanket threat. On the elevated side, the vector shows AV:N (network reachable), PR:N (no authentication), and high confidentiality and integrity impact (VC:H/VI:H) - an attacker who succeeds can read and tamper with the entire proxied RDP session. On the mitigating side, AC:H, AT:P, and UI:P indicate the attack is NOT trivially automatable: the attacker must already hold a privileged network position to intercept the proxy's outbound connection, must win a timing/path race, and a victim session must be actively proxied. No EPSS score is provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed active exploitation and not a widespread opportunistic threat. The reporting source is VulnCheck via a coordinated GitHub Security Advisory, suggesting a responsibly-disclosed research finding rather than an observed in-the-wild campaign. Net: a genuine but position-dependent risk - prioritize for environments that actually run FreeRDP in proxy mode on untrusted network paths, but it is not a drop-everything internet-wide emergency.

An attacker who controls a network segment between a FreeRDP proxy and its intended RDP target (e.g. via ARP/DNS spoofing or a compromised upstream router) intercepts the proxy's outbound TLS connection and presents a self-signed, wrong-hostname certificate. Because the proxy accepts untrusted target certificates when no verification module is configured, it establishes the session with the attacker, who relays or records the proxied session data. No public exploit is identified at time of analysis, and the high attack complexity means the attacker must already hold a privileged on-path position and catch an active proxied session.