Bug 2565967 (CVE-2026-121392)

Summary: CVE-2026-121392 FreeRDP: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FreeRDP. A man-in-the-middle attacker possessing a certificate issued by a trusted Certificate Authority (CA) can exploit improper certificate identity validation during connection establishment. Because the client incorrectly accepts fallback certificate names and improperly validates IP addresses, server identity verification can be bypassed. Consequently, an attacker can intercept Remote Desktop Protocol (RDP) sessions to view and capture sensitive data, including screen displays, keystrokes, and clipboard contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567353, 2567354    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 17:02:25 UTC 
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.