FreeRDP EUVD-2026-51840

Exploitation requires the FreeRDP client (version <= 3.28.0) to be configured to tunnel its RDP connection through an HTTP proxy - this proxy-tunneling mode is the specific code path (http_proxy_connect) that writes the unfiltered value into the CONNECT request line and Host header. It also requires the client to connect to, or be redirected to, an attacker-controlled or compromised RDP server that can send a crafted redirection PDU with CRLF/control characters in the TargetNetAddress field. Limiting factors: without HTTP proxy tunneling the injection sink is never reached; the attacker must control the RDP server side of the session; and the victim must initiate/accept the RDP connection or redirection, so this is a client-side, server-to-client attack rather than exploitation of an exposed listening service.

The vendor's CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) is high, but the real-world risk is more nuanced than that score implies. Exploitation is not a generic remote-unauthenticated attack against an exposed service: it requires the victim FreeRDP client to (a) be configured to tunnel through an HTTP proxy - a non-default deployment choice - and (b) connect to or be redirected to an attacker-controlled or compromised RDP server. The vector's UI:N and AT:N therefore understate the practical preconditions, since a user action to initiate the RDP session and a specific proxy configuration are both needed; this is worth verifying against the vendor advisory. The declared VC:H/VI:H/VA:H impact also appears optimistic for what is fundamentally a header/request-injection primitive against the proxy channel - the concrete, well-supported impact is integrity of the proxy request (request smuggling, tunnel redirection, header forgery) rather than guaranteed full confidentiality/availability loss on the endpoint. There is no EPSS score, no KEV listing, and no public PoC provided, so this reads as a genuine but conditional client-side issue best prioritized for environments that proxy RDP, rather than an internet-wide mass-exploitation threat.

An attacker operating or having compromised an RDP server waits for (or lures, via a malicious .rdp file or a redirect from a benign-looking server) a FreeRDP client that tunnels through a corporate HTTP proxy. The server returns a redirection PDU whose TargetNetAddress contains CRLF sequences followed by attacker-chosen HTTP headers or a smuggled request; when the client builds its proxy CONNECT, those bytes are emitted verbatim, letting the attacker forge the Host/headers or smuggle a second request through the proxy. No public exploit code was identified at time of analysis, so this scenario is based on the described injection primitive rather than a released PoC.