CVE-2026-67292 Overview
CVE-2026-67292 is a buffer over-disclosure vulnerability in FreeRDP versions prior to 3.29.0. The flaw resides in the gateway WebSocket transport code at libfreerdp/core/gateway/websocket.c. When the client responds to a WebSocket Ping frame, it reuses a fixed 1024-byte response stream without sealing the reply length to the actual received Ping payload size. A malicious gateway or WebSocket peer can send a non-empty Ping control frame and receive an overlong Pong reply, disclosing memory bytes beyond the intended payload. Because the peer supplies the masking key, it can unmask the disclosed bytes. A zero-length Ping triggers an assertion and terminates the client, causing denial of service.
Critical Impact
A malicious RDP gateway can disclose FreeRDP client process memory through crafted WebSocket Ping frames or crash the client with a zero-length Ping.
Affected Products
- FreeRDP versions prior to 3.29.0
- FreeRDP-based RDP clients using the gateway WebSocket transport
- Downstream distributions and applications bundling vulnerable FreeRDP releases
Discovery Timeline
- 2026-08-01 - CVE-2026-67292 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67292
Vulnerability Analysis
The defect maps to [CWE-130: Improper Handling of Length Parameter Inconsistency]. FreeRDP's WebSocket transport handles server-initiated Ping control frames by returning a Pong reply. The client allocates a static 1024-byte response stream and copies the Ping payload into it, but it does not update the reply length to reflect the actual payload size received. The full 1024-byte buffer is then transmitted back to the peer.
Because the trailing bytes of that reply buffer contain uninitialized or stale process memory, the peer receives data that was never part of the legitimate Ping payload. The WebSocket masking key, which the peer itself generated, allows the peer to unmask and read the disclosed bytes directly. Repeated Pings can be used to sample additional memory regions over time.
Root Cause
The reply construction logic in libfreerdp/core/gateway/websocket.c treats the 1024-byte response stream as if it were always a full-length payload. The Pong write path does not truncate the outbound frame to the length of the received Ping payload. Additionally, a zero-length Ping reaches an assertion in the same code path, terminating the process instead of being handled gracefully.
Attack Vector
Exploitation requires the FreeRDP client to connect to an attacker-controlled or compromised RDP gateway that speaks the WebSocket transport. No authentication or user interaction beyond initiating the connection is required. The attacker sends a non-empty Ping control frame and reads the overlong Pong reply, or sends a zero-length Ping to crash the client. See the FreeRDP Security Advisory GHSA-8v6m-2cmc-chx9 and the VulnCheck Advisory for technical details. The upstream fix is available in FreeRDP commit f3b4347.
Detection Methods for CVE-2026-67292
Indicators of Compromise
- Outbound RDP-over-WebSocket connections from workstations to unfamiliar gateway hosts or non-corporate infrastructure.
- Unexpected FreeRDP client process crashes coinciding with active gateway sessions, consistent with the zero-length Ping assertion.
- Anomalous volumes of WebSocket Ping/Pong control frames within a single RDP gateway session.
Detection Strategies
- Inventory endpoints running FreeRDP builds earlier than 3.29.0, including third-party applications that embed the library.
- Inspect gateway traffic for WebSocket Ping frames with non-standard or attacker-controlled payload sizes, which are unusual for legitimate RDP gateways.
- Alert on xfreerdp, wlfreerdp, or embedded FreeRDP processes exiting via SIGABRT shortly after establishing a WebSocket gateway session.
Monitoring Recommendations
- Capture process telemetry and command-line arguments for FreeRDP clients, including the /g: gateway parameter, to correlate connections against approved gateway hosts.
- Log TLS SNI and destination IP data for outbound 443/tcp traffic originating from RDP clients and baseline expected gateway endpoints.
- Monitor for repeated short-lived WebSocket sessions from the same endpoint, which may indicate iterative memory sampling attempts.
How to Mitigate CVE-2026-67292
Immediate Actions Required
- Upgrade all FreeRDP installations to version 3.29.0 or later across managed and unmanaged endpoints.
- Identify third-party applications that statically link or bundle FreeRDP and apply vendor updates that incorporate the fix.
- Restrict outbound RDP gateway connections to an allowlist of trusted, corporate-operated gateway hosts.
Patch Information
The issue is resolved in FreeRDP 3.29.0. The upstream fix seals the Pong reply length to the received Ping payload size and handles zero-length Pings without triggering the assertion. Refer to FreeRDP commit f3b4347 and GHSA-8v6m-2cmc-chx9 for the authoritative patch and advisory.
Workarounds
- Where patching is delayed, disable the RDP gateway WebSocket transport and use direct TLS-based RDP connections to trusted hosts only.
- Block outbound connections from FreeRDP clients to untrusted gateways at the network egress or host firewall.
- Require users to authenticate to a VPN before permitting any RDP gateway traffic, reducing exposure to arbitrary attacker-controlled gateways.
# Verify installed FreeRDP client version and confirm it is 3.29.0 or later
xfreerdp --version
# Debian/Ubuntu example: upgrade FreeRDP packages once distribution builds ship 3.29.0+
sudo apt update && sudo apt install --only-upgrade freerdp3-x11 libfreerdp3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
