Improper Certificate Validation in FreeRDP Affects Multiple Users

CVE-2026-67293

What is CVE-2026-67293?

FreeRDP versions prior to 3.29.0 exhibit an improper validation issue concerning TLS certificate hostnames. Specifically, the hostname matcher (tls_match_hostname()) incorrectly interprets wildcard patterns such as *.example.com as valid for all subdomains, potentially allowing malicious actors to exploit this flaw. This could enable a rogue server to impersonate legitimate sites by using wildcard certificates, undermining the trust established by TLS and weakening server authentication in environments using multi-label subdomains.

References