CVE-2026-67292Medium· 6.5▾ SunlitFreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
freerdp < 3.29.0Upgrade past the affected range:
freerdp 3.29.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67294Medium· 5.9FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication
CVE-2026-67293Medium· 4.2FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability
CVE-2026-67289Critical· 9.8FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field
CVE-2026-114041Medium· 6.5freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read (CVE-2026-114041)
CVE-2026-114042Medium· 6.5FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
CVE-2026-114044Medium· 5.3freerdp: FreeRDP: Android client heap out-of-bounds read via graphics pipeline (CVE-2026-114044)