Skip to main content

FreeRDP CVE-2026-67292

| EUVDEUVD-2026-51811 CRITICAL
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-08-01 VulnCheck GHSA-v4xr-wq7x-967g
Denial Of Service Freerdp Red Hat Suse
Critical
Disputed · 9.3 Vendor: VulnCheck
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Malicious peer needs no auth (PR:N) over the network (AV:N/AC:L); impact is limited stale-buffer disclosure (C:L) plus an assertion crash DoS (A:H), with no described integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:01 vuln.today
Analysis Generated
Aug 01, 2026 - 13:01 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
CRITICAL 9.3

DescriptionCVE.org

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

AnalysisAI

Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position as/MITM the WebSocket gateway
Delivery
Victim client connects through peer
Exploit
Send non-empty or zero-length Ping frame
Execution
Client emits overlong Pong from reused buffer
Impact
Read leaked memory and masking key, or crash client
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the FreeRDP client to be using the gateway WebSocket transport (RDP tunneled over HTTPS/WebSocket) and to connect to an attacker-controlled or man-in-the-middle WebSocket gateway/peer; the malicious peer then sends a non-empty Ping control frame to trigger the over-disclosure, or a zero-length Ping to trigger the assertion-based denial of service. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates all three impacts High, but the described behavior does not clearly support VI:H - the vulnerability is an information over-disclosure (confidentiality) plus an assertion-based crash (availability), with no described mechanism to modify client data or execute code, so the integrity rating appears inflated versus the description; verify with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who controls or man-in-the-middles the RDP gateway a victim connects to sends a crafted non-empty WebSocket Ping to the FreeRDP client; the client replies with an overlong Pong drawn from its reused 1024-byte buffer, leaking adjacent memory and the masking key so the attacker can unmask and read the disclosed bytes. Alternatively, the attacker sends a zero-length Ping to trip the client's assertion and terminate the session (DoS). …
Remediation Upgrade FreeRDP to version 3.29.0 or later, which seals the Pong response length to the received Ping payload (Vendor-released patch: 3.29.0, referenced by GHSA-8v6m-2cmc-chx9 and fix commit f3b4347105114fe7453828736bea069999af319f). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an asset inventory to identify all systems running FreeRDP clients and their current versions; prioritize systems with network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2024-42460 MEDIUM POC
5.3
CVE-2026-54466 CRITICAL
9.2
CVE-2026-9054 CRITICAL
9.2

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67292 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy