---
id: CVE-2026-67292
title: >-
  FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the
  gateway WebSocket transport (libfreerdp/core/gateway/websocket.c)
summary: >-
  FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the
  gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The
  client's Pong reply reuses a fixed 1024-byte response stream whose length is
  not sealed t…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-130
vendor: freerdp
product: freerdp
affected:
  - freerdp < 3.29.0
patched:
  - freerdp 3.29.0
published: '2026-08-01'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T21:02:51.287'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67292'
references:
  - url: >-
      https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00479
epssPercentile: 0.38726
ingestedAt: '2026-08-02T05:17:49.495Z'
---

## Overview

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

## Affected

- `freerdp < 3.29.0`

## Remediation

Upgrade past the affected range:

- `freerdp 3.29.0`