CVE-2026-67292
Low
No strong exploitation signal.
CVSS base
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
EPSS — probability of exploitation (30 days)
0.3%
26.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-130
Published 2026-08-01 · modified 2026-09-11
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | L | Low |
Timeline
- 2026-08-01 — Published (NVD)
- 2026-09-11 — Last modified (NVD)
Description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
Affected
References
- https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
- exploit https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9
- https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure
- exploit https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9