CVE-2026-67292
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious peer causes an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping triggers an assertion and terminates the client (denial of service).
Risk Assessment
A malicious WebSocket peer can gain unauthorized access to client memory data or cause denial of service.
Recommendation
Update FreeRDP to version 3.29.0 or later, which includes the fix for the WebSocket transport.
Other vulnerabilities in FreeRDP
See all- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
- CVE-2026-22856High
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2013-4119High
FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
- CVE-2013-4118High
FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash.
- CVE-2014-0250High
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the xf_Pointer_New or xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
- CVE-2026-68579Critical
FreeRDP before 3.30.0 has a heap-based buffer overflow in CliprdrStream_Read. A malicious RDP server can send an oversized response, causing an out-of-bounds write.
- CVE-2026-67305Critical
FreeRDP Windows client before version 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.
- CVE-2026-67289Critical
FreeRDP before version 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
- CVE-2026-66402Critical
FreeRDP before version 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.
- CVE-2026-64620Critical
A heap-based buffer overflow in FreeRDP before version 3.28.0 (affected <=3.27.1) in the crypto_rsa_common() function. The function writes the modular exponentiation result to the output buffer before checking bounds, allowing out-of-bounds writes.
Original NVD description (English source)
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).