FreeRDP CVE-2026-67289

|

EUVD

EUVD-2026-51840 CRITICAL

HTTP Response Splitting (CWE-113)

2026-08-01 VulnCheck

GHSA-3x8f-6ffv-v2wc

Code Injection Freerdp

Critical

Disputed · 9.3 Vendor: VulnCheck

Share

Severity by source

Sources disagree (Medium–Critical)

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.9 MEDIUM

Requires a non-default HTTP proxy config and the user connecting to a malicious server (AC:H, UI:R); injection targets the separate proxy component (S:C) with primarily integrity impact on the proxy request (I:H, C:L, A:N).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N

SUSE

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

5.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

X

Lifecycle Timeline

3

Source Code Evidence Fetched

Aug 01, 2026 - 13:01 vuln.today

Analysis Generated

Aug 01, 2026 - 13:01 vuln.today

CVE Published

Aug 01, 2026 - 12:22 cve.org

CRITICAL 9.3

DescriptionCVE.org

FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

AnalysisAI

HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.

Technical ContextAI

FreeRDP is the dominant open-source implementation of Microsoft's Remote Desktop Protocol, embedded in clients such as xfreerdp and Remmina and in numerous commercial and embedded products (CPE cpe:2.3:a:freerdp:freerdp). The flaw is a classic CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers / HTTP response/request splitting). RDP supports server-initiated redirection, in which a server returns a redirection PDU telling the client to reconnect to another target (TargetNetAddress). FreeRDP copies that attacker-controlled string into ServerHostname and, when the client is configured to tunnel RDP through an HTTP proxy, passes it directly into http_proxy_connect() where it becomes the host in the CONNECT request line and the Host header - with no validation that it excludes CR, LF, or other control characters. Because CONNECT requests are line-oriented HTTP, embedded CRLF lets the server terminate the request line early and append arbitrary headers or a second smuggled request.

RemediationAI

Vendor-released patch: FreeRDP 3.29.0 - upgrade all FreeRDP clients and any downstream products that bundle FreeRDP to 3.29.0 or later, which adds validation/filtering of the redirection target before it reaches http_proxy_connect(); see the advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm and the fix commit https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f. Where immediate patching is not possible, the most effective compensating control is to disable HTTP proxy tunneling for RDP connections (the injection sink only triggers on the proxy CONNECT path), accepting the trade-off that clients behind a mandatory forward proxy may lose RDP connectivity. Additionally, restrict clients to connecting only to trusted, known RDP servers and disable or distrust server-initiated redirection where the client supports it, since the malicious value arrives via the redirection PDU; the trade-off is reduced compatibility with legitimate load-balanced/redirecting RDP farms. Network-side, an HTTP proxy that strictly rejects CONNECT request lines and Host headers containing control characters can blunt smuggling attempts as defense-in-depth.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-113 – HTTP Response Splitting

View all

CVE-2024-52875 HIGH POC

CVE-2016-5699 MEDIUM POC

CVE-2016-8024 HIGH POC

CVE-2026-75419 HIGH POC

CVE-2018-11347 HIGH POC

CVE-2018-3911 HIGH POC

CVE-2018-7830 HIGH POC

CVE-2022-41915 MEDIUM POC

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

CVE-2021-22205 CRITICAL POC

CVE-2024-23692 CRITICAL POC

CVE-2012-0158 HIGH POC

CVE-2021-44529 CRITICAL POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected

Share

CVE-2026-67289 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy