CVE-2026-67292 Details
Description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
A buffer over-disclosure vulnerability has been identified in FreeRDP versions prior to 3.29.0, specifically within the gateway WebSocket transport. The issue arises because the client's Pong reply utilizes a fixed 1024-byte response stream, which is not properly adjusted to match the length of the received Ping payload. As a result, a malicious gateway or WebSocket peer can send a non-empty Ping control frame, causing the client to respond with an overly long Pong that leaks data beyond the original payload. This response can be unmasked by the peer, revealing the exposed bytes. Additionally, sending a zero-length Ping leads to an assertion failure that terminates the client, causing a denial-of-service condition.
Users can upgrade to FreeRDP version 3.29.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-130 | Improper Handling of Length Parameter Inconsistency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.29.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |