FreeRDP fixes 22 flaws that could let a rogue server spy on your remote desktop (CVE-2026-66402)

"Remote desktop" lets you operate a computer somewhere else from your own machine, and on Linux most of those tools are built on top of one piece of software: FreeRDP. It has just been found to contain 22 security flaws that could let someone eavesdrop on your session or hijack your connection. On July 13, 2026 the project shipped FreeRDP 3.29.0, which fixes all of them, and is urging everyone to update.

Two of the 22 are rated CRITICAL. Both come into play when the server you connect to is malicious, or when someone can sit in the middle of your network traffic, and both break the encryption protection you would normally expect. The corresponding entries, starting with CVE-2026-66402, are being published in the US National Vulnerability Database (NVD).

What FreeRDP is, and why your app may use it

FreeRDP is an open-source reimplementation of Microsoft's Remote Desktop Protocol (RDP) that anyone can use freely. It works as a standalone tool, but more importantly it is embedded as a building block (a library) inside many other apps.

The popular Linux remote-desktop app Remmina, GNOME's built-in "GNOME Connections," KDE's "KRDC," and in fact most Linux RDP clients all call FreeRDP under the hood. Many people are using it without ever knowing the name.

That is exactly what makes these flaws worrying. When a single shared component has a hole, every downstream app that bundles it is affected too. For more on how one component's flaw ripples across many products, see our explainer on open-source component supply-chain risk.

Note that the "Remote Desktop Connection" built into Windows (mstsc.exe) is a separate program made by Microsoft and is unrelated to FreeRDP. Windows' own remote desktop is not affected here. What is affected is software that uses FreeRDP, mostly apps on Linux, Mac, and mobile.

Who would exploit this, and why

The people put in a strong position by the critical flaws are attackers who can sit on the path of your traffic (on public Wi-Fi or a corporate network), or the owner of a server you connect to that has been taken over. Remote desktop is assumed to be "safe because it's encrypted," but the very mechanism that decides whether that encryption can be trusted was broken.

Such an attacker can impersonate a legitimate server, wedge into the connection, and read your screen and keystrokes that should be protected, or slip tampered data into the traffic. To the user's computer it looks like a normal, successful connection, which is what makes the interception hard to notice.

The first victim is the person doing the remote work. The IDs and passwords they type on the far end, and the contents of the screen they are working on, can be handed to a third party, who may then seize control of the session. For a company, an employee's remote connection becomes an entry point, giving attackers a foothold into internal systems. Workplaces where people connect to internal servers from home or while traveling face the biggest exposure.

The main fixed vulnerabilities

Below are the main CVE-numbered items among the 22 advisories in FreeRDP 3.29.0, ordered by severity. "Attack direction" shows whether a malicious server attacks the connecting client (the user side), or a malicious client attacks the server. Most target the user side.

Severity follows the CVSS v3.1 score (out of 10). The set also includes further certificate-validation flaws (CVE-2026-67293, CVE-2026-67294) and a partial information-leak flaw (CVE-2026-67292). For the full list, see the project's official announcement.

A closer look at the two most dangerous

CVE-2026-66402: slipping past the server's "identity check"

This is the most serious of the batch. Remote desktop traffic is protected by SSL/TLS encryption, and to confirm "is the machine I connected to the real server?" it checks a "TLS certificate," the electronic equivalent of an ID card. CVE-2026-66402 is a flaw in that identity-matching step.

Instead of using OpenSSL's safe, length-aware matching functions, FreeRDP compared the server name in the certificate with its own custom logic. As a result, a special character embedded mid-name can cut the check short, and a partial name match can cause the rest of a mismatch to be overlooked. An attacker can reuse a certificate issued for a different party and impersonate the legitimate server. The severity is rated 9.8 out of 10.

CVE-2026-67289: injecting rogue commands into the traffic

The other critical item, CVE-2026-67289, matters when connecting through a proxy (a server that relays traffic), as is common in corporate networks. The connection request FreeRDP sends to the relay can have control characters (line breaks) smuggled into it by an attacker.

Because the text of a request is delimited by those line breaks, inserting a fake delimiter lets an attacker split one request and slip in a separate command (a technique called HTTP response splitting). This can fool the relay server, leading to theft of connection details or hijacking of the traffic. This too is rated 9.8.

Some flaws trigger just by connecting to a bad server

Beyond the two critical items, there are many "High (7.5)" flaws. The notable point is that most of them trigger simply when a user connects to a malicious server. Video playback handling (CVE-2026-67290), on-screen glyph drawing (CVE-2026-67291), shape drawing (CVE-2026-67301), and smart-card authentication (CVE-2026-67288) all had bugs that read memory beyond its intended bounds, or reused already-freed memory.

By luring a user into connecting to a crafted server, these can crash the app or, under the right conditions, be used as a stepping stone to run malicious code. The basic rule "don't carelessly connect to unknown servers" matters more than ever here.

On the other hand, flaws like CVE-2026-67296 and CVE-2026-67298 let a malicious client attack a machine running FreeRDP as a server and knock the service offline. If you run the "receiving" side of remote access with FreeRDP, you also need to update.

Are you affected? What to do, by app

Affected versions are FreeRDP 3.28.0 and earlier; the fix is 3.29.0. But most people use FreeRDP indirectly through another app. Match your situation below.

On Linux, running your normal OS software update (Ubuntu's "Software Updater," or apt update && apt upgrade) swaps in the fixed FreeRDP build your distribution has prepared. Timing differs by distribution, so apply the update promptly when FreeRDP or Remmina appears in the update list. If you build from source, get it from the GitHub 3.29.0 release or the official download page.

Who reported it, and the exploitation status

The fixes are based on reports from several security researchers. According to the project, Bin Luo of UESTC reported 18 of the 22, with Team Atlanta, @canomer, @HEXER365, and Tencent's Yunding Security Lab also credited. FreeRDP lead developer Armin Novak (akallabeth) states in the release notes that "an update is highly recommended." Help Net Security and Linuxiac also covered the release.

As of this writing (August 1, 2026), there is no official report of these flaws being used in real-world attacks. That said, a flaw that slips past certificate checks is especially attractive for remote access over untrusted networks such as public Wi-Fi. Updating before exploitation spreads is the safe choice.

Bottom line

FreeRDP 3.29.0 is an important update that fixes 22 security advisories in one go. The certificate-bypass flaw (CVE-2026-66402) and the traffic-injection flaw (CVE-2026-67289) are the most urgent, and both undermine the "it's encrypted, so it's safe" assumption of remote desktop.

If you use Remmina or GNOME Connections to work remotely on Linux, check your system's software updates first. In most cases a normal OS update swaps in the fixed build. If you develop a product that bundles FreeRDP, you need to raise the bundled version to 3.29.0 or later.

Sources

• ▸ FreeRDP - 3.29.0 release (official announcement) (July 13, 2026)
• ▸ GitHub - FreeRDP/FreeRDP Release 3.29.0
• ▸ Help Net Security - FreeRDP 3.29.0 security update resolves 22 advisories (July 15, 2026)
• ▸ Linuxiac - FreeRDP 3.29 Is Out With Extensive Security Fixes
• ▸ NVD - CVE-2026-66402
• ▸ NVD - CVE-2026-67289
• ▸ Remmina - the free Linux RDP client