CVE-2026-67290 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP versions before 3.29.0 should prioritize patching due to the high severity of this vulnerability. Affected operators, platforms, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management and security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. This vulnerability affects FreeRDP's TSMF FFmpeg decoder and requires immediate attention from operators and security teams to prevent potential exploitation attempts. The vulnerability's high CVSS score of 8.7 indicates a critical vulnerability that requires high-priority defensive actions. Security teams should also consider implementing monitoring to detect potential exploitation attempts and verifying FreeRDP versions to confirm if vulnerable versions are in use. Affected product deployments should be verified, and owners assigned for follow-up to ensure timely remediation of this critical vulnerability. Security teams should prioritize patching and implement compensating controls to mitigate potential risks associated with this vulnerability. FreeRDP versions before 3.29.0 should be upgraded to 3.29.0 or later to remediate the vulnerability. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review to prevent potential exploitation attempts. The vulnerability's impact on affected operators and platforms should be carefully reviewed to ensure that all necessary defensive actions are taken to prevent potential exploitation attempts. Security teams should also consider tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented to ensure that the vulnerability is fully remediated. The high severity of this

Technical summary

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating source buffer length. This vulnerability has a high CVSS score of 8.7, indicating a critical vulnerability in FreeRDP before version 3.29.0.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.7 for CVE-2026-67290, indicating a critical vulnerability in FreeRDP before version 3.29.0.

Recommended defensive actions

• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Implement monitoring to detect potential exploitation attempts.

Evidence notes

Evidence is limited; primary official records indicate a heap out-of-bounds read vulnerability in FreeRDP's TSMF FFmpeg decoder. Defensive verification tasks are recommended to confirm affected scope and validate vendor remediation. The vulnerability was disclosed on 2026-08-01 and has not been modified since then. Affected product deployments should be verified, and owners assigned for follow-up.

Official resources