CVE-2026-114047

MEDIUM 6.8

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

CWE	CWE-295
Vendor	freerdp
Product	freerdp
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

FreeRDP / FreeRDP

2.0.0 < 3.32.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4 vulncheck.com: https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-proxy-improper-tls-certificate-validation

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence