CVE-2026-67292 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP before version 3.29.0 should be aware of this vulnerability and take steps to mitigate it. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams who need to assess the impact and implement necessary controls. Affected organizations should prioritize updating to the latest version to prevent potential buffer over-disclosure vulnerabilities in the gateway WebSocket transport. Additionally, organizations should review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for suspicious activity and exception tracking. Inventory checks should be conducted to identify potentially affected systems. The CVE-2026-67292 vulnerability in FreeRDP before version 3.29.0 is a buffer over-disclosure issue in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, allowing a malicious gateway/WebSocket peer to cause the client to reply with an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping causes an assertion and terminates the client, resulting in a denial of service. Evidence is based on limited source detail; further verification is recommended. The CVE record was published on 2026-08-01T13:16:58.240Z and has not been modified since then. AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T13:16:58.240Z and has not been modified since then. The CVE-2026-67292 vulnerability in FreeRDP before version 3.29.0 is a buffer over-disclosure issue in the gateway WebSocket transport. A malicious gateway/WebSocket peer can cause the client to reply with an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping causes an assertion and terminates the client, resulting in a denial of service. Evidence is based on limited source detail; further verification is recommended. The CVE-2026-67292 vulnerability in FreeRDP before version 3.29.0 is a buffer over-disclosure issue in the gateway WebS

Technical summary

The CVE-2026-67292 vulnerability in FreeRDP before version 3.29.0 is a buffer over-disclosure issue in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, allowing a malicious gateway/WebSocket peer to cause the client to reply with an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping causes an assertion and terminates the client, resulting in a denial of service.

Defensive priority

Organizations using FreeRDP before version 3.29.0 should prioritize updating to the latest version to prevent potential buffer over-disclosure vulnerabilities in the gateway WebSocket transport.

Recommended defensive actions

• Update FreeRDP to version 3.29.0 or later
• Implement compensating controls to monitor and restrict WebSocket traffic
• Conduct inventory checks to identify potentially affected systems
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-67292 vulnerability in FreeRDP before version 3.29.0 is a buffer over-disclosure issue in the gateway WebSocket transport. A malicious gateway/WebSocket peer can cause the client to reply with an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping causes an assertion and terminates the client, resulting in a denial of service. Evidence is based on limited source detail; further verification is recommended.

Official resources