CVE-2026-67292
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious peer causes an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping triggers an assertion and terminates the client (denial of service).
Risk Assessment
A malicious WebSocket peer can gain unauthorized access to client memory data or cause denial of service.
Recommendation
Update FreeRDP to version 3.29.0 or later, which includes the fix for the WebSocket transport.
Other vulnerabilities in FreeRDP
See all- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
- CVE-2026-22856High
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2013-4119High
FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
- CVE-2013-4118High
FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash.
- CVE-2014-0250High
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the xf_Pointer_New or xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
- CVE-2026-91949Critical
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
- CVE-2026-63633Critical
In FreeRDP before 3.28.0, freerdp_dsp_decode_opus calls Stream_EnsureRemainingCapacity on the context buffer even though opus_decode writes to the caller-supplied stream. A malicious RDP server negotiating WAVE_FORMAT_OPUS can cause large decoded frames to be written beyond the allocated buffer, leading to client heap corruption, crash, and potential code execution.
- CVE-2026-55194Critical
In FreeRDP before 3.27.0, rpc_client_recv_fragment ensures response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a response with a small alloc_hint and a much larger frag_length, causing a buffer overflow in the pdu->s buffer. This can crash the client and may permit code execution.
- CVE-2026-55191Critical
In FreeRDP before 3.27.0, clients negotiating RDPGFX AVC444 calculate the intermediate YUV444 allocation size using 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions causing integer wrap, leading to an undersized buffer allocation. This can cause a client crash and may permit code execution.
- CVE-2026-73242Critical
FreeRDP, a free implementation of the Remote Desktop Protocol, prior to version 3.30.0 has a vulnerability in the kerberos_DecryptMessage function that fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets. A malicious RDP peer can trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption.
Original NVD description (English source)
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS