Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck
CVE-2026-67292FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure
Medium 6.5
In plain English
A medium-severity security flaw in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-67292 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-67292 |
| Debian:14 | freerdp3 | 3.29.0+dfsg-1 | DEBIAN-CVE-2026-67292 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-67292 |
| Ubuntu:24.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-67292 |
| Ubuntu:26.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-67292 |
Affected products (as reported)
Weakness: CWE-130 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
References
- GitHub Security Advisory (GHSA-8v6m-2cmc-chx9) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure third-party-advisory