CVE-2026-67292

FreeRDP before 3.29.0 mishandles Pong replies in its gateway WebSocket transport (libfreerdp/core/gateway/websocket.c): the reply is built from a fixed 1024-byte response stream whose length is never sealed to the size of the received Ping payload. A malicious or compromised gateway/WebSocket peer can send a non-empty Ping control frame, causing the client to answer with an overlong Pong that discloses bytes of client memory beyond the received payload; because the peer knows the masking key, it can unmask and read those extra bytes. A zero-length Ping instead reaches an assertion and terminates the client, giving the same peer a trivial remote denial of service. Anyone using a FreeRDP-based RDP client (distribution packages, Remmina, thin clients, VDI front ends) that connects through a WebSocket-transport RD gateway is affected. No in-the-wild exploitation is known: EPSS is 0.3% (18th percentile), the flaw is not in CISA KEV, and there is one public advisory/PoC reference.

What to do: Upgrade FreeRDP to 3.29.0 or later (or apply vendor/distribution backported patches) on systems whose RDP clients use the WebSocket gateway transport. Until patched, restrict clients to trusted, TLS-verified gateways and avoid untrusted WebSocket-transport gateway endpoints. Also audit bundled/embedded copies of FreeRDP in thin clients, Remmina and VDI products for vulnerable pre-3.29.0 versions.