Skip to main content

FreeRDP EUVDEUVD-2026-51811

| CVE-2026-67292 CRITICAL
Improper Handling of Length Parameter Inconsistency (CWE-130)
2026-08-01 VulnCheck GHSA-v4xr-wq7x-967g
Denial Of Service Freerdp
Critical
Disputed · 9.3 Vendor: VulnCheck
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Malicious peer needs no auth (PR:N) over the network (AV:N/AC:L); impact is limited stale-buffer disclosure (C:L) plus an assertion crash DoS (A:H), with no described integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:01 vuln.today
Analysis Generated
Aug 01, 2026 - 13:01 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
CRITICAL 9.3

DescriptionCVE.org

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

AnalysisAI

Memory over-disclosure and denial of service in FreeRDP RDP clients (before 3.29.0) using the gateway WebSocket transport allows a malicious or man-in-the-middle gateway/WebSocket peer to read bytes beyond a received Ping payload or crash the client. Because the client's Pong reply reuses a fixed 1024-byte response stream whose length is never sealed to the actual Ping payload, a non-empty Ping causes the client to return an overlong Pong that leaks stale buffer contents (including the masking key, which lets the peer unmask the reply); a zero-length Ping hits an assertion and terminates the client. Reported by VulnCheck; a vendor patch is available, but no public exploit was identified at time of analysis.

Technical ContextAI

FreeRDP is a widely used open-source implementation of the Microsoft Remote Desktop Protocol, shipped in clients such as xfreerdp and Remmina and embedded in many third-party products. The affected code is the WebSocket-based RDP gateway transport in libfreerdp/core/gateway/websocket.c, used when the client tunnels RDP over HTTPS/WebSocket to a Remote Desktop Gateway. When the peer sends a WebSocket Ping control frame, the client must echo the payload back in a Pong. The flaw is CWE-130 (Improper Handling of Length Parameter Inconsistency): the Pong is written into a persistent, fixed 1024-byte response stream whose length is not reset/sealed to the number of bytes actually received in the Ping, so the client emits more bytes than it received - disclosing leftover memory from the reused buffer - and a zero-length Ping violates a size assumption, tripping an assert() that aborts the process.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which seals the Pong response length to the received Ping payload (Vendor-released patch: 3.29.0, referenced by GHSA-8v6m-2cmc-chx9 and fix commit f3b4347105114fe7453828736bea069999af319f). If immediate upgrade is not possible, avoid the WebSocket gateway transport and connect over a trusted, non-WebSocket gateway path, and only connect through Remote Desktop Gateways you control and trust - since the attacker must act as the gateway/WebSocket peer, ensuring the gateway endpoint is authenticated (valid TLS certificate, no interceptable proxy) removes the malicious-peer precondition, at the trade-off of reduced flexibility for users relying on WebSocket-based gateways. Downstream products that vendor FreeRDP should rebuild against the patched library. See the vendor advisory (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9) and the VulnCheck advisory (https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure).

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-130 – Improper Handling of Length Parameter Inconsistency

View all
CVE-2022-1543 HIGH POC
8.8
CVE-2022-3290 HIGH POC
7.5
CVE-2022-3272 HIGH POC
7.5
CVE-2021-36090 HIGH
7.5
CVE-2022-2714 CRITICAL
9.8
CVE-2021-20588 CRITICAL
9.8
CVE-2021-35517 HIGH
7.5
CVE-2024-42460 MEDIUM POC
5.3

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-51811 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy