CVE-2026-114047: FreeRDP 2.0.0 to before 3.32.0

Affected technology

FreeRDP · 2.0.0 to before 3.32.0
FreeRDP

Description’s affected range: before 3.32.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data. Vendor/CNA’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none.