Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:18 FreeRDP: FreeRDP: Information Disclosure and Denial of Service via WebSocket Ping 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CWE-805

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

A flaw was found in FreeRDP, a remote desktop protocol client. A malicious server or WebSocket peer could send a specially crafted Ping control frame. This could cause the client to send an overly long Pong reply, leading to the disclosure of sensitive information beyond the intended payload. Additionally, sending a zero-length Ping could trigger an assertion, causing the client to terminate and resulting in a denial of service.

This issue is classified as Moderate severity because successful exploitation requires a user to connect to a malicious gateway or server, where a crafted Ping control frame can trigger a client memory disclosure or cause an application crash leading to a denial of service. To mitigate this vulnerability, avoid connecting to untrusted RDP gateways when using FreeRDP. This flaw specifically affects the client when interacting with a malicious gateway, which can exploit the WebSocket transport to trigger information disclosure or a denial of service. Red Hat Enterprise Linux 10 Fix deferred freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Fix deferred freerdp Red Hat Enterprise Linux 9 Fix deferred freerdp https://www.cve.org/CVERecord?id=CVE-2026-67292 https://nvd.nist.gov/vuln/detail/CVE-2026-67292 https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure