FreeRDP CVE-2026-67297

The attacker must control or successfully impersonate the RD Gateway HTTPS endpoint that the FreeRDP client is configured to connect to - this is the binding prerequisite. The FreeRDP client must be using the RD Gateway feature (clients connecting directly via RDP without a gateway are not exposed). The malicious server must respond using Transfer-Encoding: chunked encoding rather than a standard Content-Length response. No authentication to the gateway or privileges on the client system are required, since the attacker operates as the server. Exploitation is limited to clients running FreeRDP versions below 3.29.0. Defenders should assess whether their FreeRDP deployments route through RD Gateway, whether those gateways are cryptographically pinned or access-controlled, and whether clients could be redirected to attacker-controlled endpoints through DNS manipulation or social engineering.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, indicating a network-reachable, zero-complexity denial-of-service with no prerequisites on the client side. However, this score must be contextualized: the attacker must either operate or impersonate the RD Gateway HTTPS endpoint the FreeRDP client connects to, which is a meaningful precondition that prevents mass-scanning exploitation. This is not a vulnerability exploitable against arbitrary internet hosts. The absence of a CISA KEV listing and no reported public exploit code further reduces immediate operational urgency. EPSS data was not provided in the available intelligence. Real-world risk is highest in environments where FreeRDP clients may connect to gateways that are not cryptographically pinned or organizationally controlled - e.g., BYOD or remote-work scenarios with user-selected gateways. The pure availability impact (VA:H, VC/VI/SC/SI all N) limits the blast radius to client-side crashes with no data exposure.

An attacker operates a malicious RD Gateway HTTPS server and redirects a FreeRDP client to it via DNS hijacking, a phishing-delivered connection file, or man-in-the-middle positioning on an untrusted network. Once the FreeRDP client completes the TLS handshake and sends its RD Gateway HTTP request, the attacker's server responds with a Transfer-Encoding: chunked body, continuously streaming oversized chunks that the client accumulates in heap memory without hitting the disabled RESPONSE_SIZE_LIMIT guard, ultimately exhausting available memory and crashing the client process. No public POC code has been identified at time of analysis.