Buffer over-disclosure and DoS via WebSocket Ping handling in FreeRDP (CVE-2026-67292)

FreeRDP's gateway WebSocket transport mishandles server-sent Ping control frames. A non-empty Ping causes the client to reply with an overlong Pong disclosing up to 1024 bytes of buffer contents beyond the received payload; because the peer receives the masking key, it can recover the disclosed data. A zero-length Ping triggers a failed assertion, terminating the client and causing a denial of service. Affected versions: - <= 3.28.0 We recommend updating to: 3.29.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 Details: https://vuln.today/cve/CVE-2026-67292