The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdpUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-devel | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | No solution exists | Aug 4, 2026 | Aug 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub