CVE-2026-67292 · Symaro Security Advisory

Description

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

Severity (CVSS)

Base score	9.3
Severity	Critical
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-130 — Improper Handling of Length Parameter Inconsistency

Affected products

Vendor	Product	Versions
FreeRDP	FreeRDP	0 to <3.29.0; 3.29.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 (vendor-advisory)
https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f (patch)
https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 02 Aug 2026 07:05 UTC.