Improper Certificate Validation Vulnerability in FreeRDP by FreeRDP

CVE-2026-114047

What is CVE-2026-114047?

FreeRDP, up to version 3.32.0, is susceptible to an improper certificate validation vulnerability. This issue arises in its proxy component, where it accepts untrusted TLS certificates when no validation module is set up. Malicious actors positioned within the network could exploit this vulnerability by intercepting outbound connections made by the proxy. They can present self-signed certificates that incorrectly match the intended hostname, thereby impersonating the RDP target and capturing proxied session data, leading to potential data breaches and unauthorized access.

References