CVE-2026-67292 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within FreeRDP's gateway WebSocket transport implementation where a buffer over-disclosure occurs due to improper handling of WebSocket ping-pong control frames. The flaw resides in libfreerdp/core/gateway/websocket.c where the client's pong response mechanism fails to properly validate or constrain the response size relative to the incoming ping payload length. When a malicious gateway or websocket peer sends a non-empty ping control frame, the client responds with a pong message that utilizes a fixed 1024-byte buffer regardless of the actual ping payload size. This creates a situation where the pong reply extends beyond the intended payload boundaries, inadvertently disclosing memory contents that follow the allocated buffer in the client's memory space.
The vulnerability operates through the WebSocket protocol's control frame mechanism where ping and pong frames serve as keep-alive and response messages between peers. The client's implementation does not properly validate the size relationship between incoming ping payloads and outgoing pong responses, creating a predictable buffer overflow scenario. An attacker can craft malicious ping frames with specific lengths to cause the client to disclose sensitive information from adjacent memory regions, potentially including cryptographic keys, session tokens, or other confidential data that may be stored in memory immediately following the fixed 1024-byte response buffer.
This issue directly maps to CWE-121 Stack-based Buffer Overflow and CWE-122 Heap-based Buffer Overflow categories within the Common Weakness Enumeration framework, representing a classic buffer over-read vulnerability where the system reads beyond allocated memory boundaries. The operational impact extends beyond simple information disclosure as this vulnerability can be exploited to extract sensitive data from the client's memory space, potentially compromising authentication tokens, encryption keys, or other critical security elements that may be present in adjacent memory locations. The vulnerability also presents a denial of service risk when zero-length pings are sent, causing an assertion failure and termination of the FreeRDP client process.
The attack vector involves a malicious gateway or websocket peer that can intercept or spoof communication with the FreeRDP client, making this particularly dangerous in network environments where such intermediaries exist. This vulnerability affects all versions prior to 3.29.0 and represents a significant security risk for organizations relying on FreeRDP's gateway functionality for remote desktop connections. The issue demonstrates poor input validation practices and inadequate buffer management in the WebSocket transport layer, exposing the client to potential data leakage and service disruption attacks.
Mitigation strategies include upgrading to FreeRDP version 3.29.0 or later where the buffer handling has been corrected to properly constrain pong response sizes relative to incoming ping payloads. Additionally, organizations should implement network segmentation and monitoring to detect unusual WebSocket control frame patterns that may indicate exploitation attempts. The fix typically involves implementing proper bounds checking on the pong response generation process, ensuring that the response size never exceeds the actual payload length of the received ping message. Network-level protections such as websocket protocol filtering and traffic analysis can help detect and prevent exploitation attempts while maintaining operational continuity for legitimate users.