CVE-2026-67292
Received Received - Intake

Buffer Over-Disclosure in FreeRDP Gateway WebSocket Transport

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67292
EUVD
EUVD-2026-51811

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a buffer over-disclosure issue in its gateway WebSocket transport. When the client receives a Ping control frame from a malicious gateway, it replies with a Pong message that includes extra data beyond the actual received payload. This happens because the client reuses a fixed 1024-byte response stream without adjusting its length to match the Ping payload size. A zero-length Ping causes the client to crash due to an assertion failure.

Detection Guidance

This vulnerability is specific to FreeRDP versions before 3.29.0. To detect it, check the installed FreeRDP version using the command: freerdp2 --version. If the version is below 3.29.0, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to read sensitive data from memory if they control the gateway or WebSocket peer. It may also cause the FreeRDP client to crash, leading to a denial of service. Users running vulnerable versions should update to FreeRDP 3.29.0 or later to mitigate these risks.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later immediately. If upgrading is not possible, avoid using FreeRDP in environments where untrusted gateways or peers are present to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart