CVE-2026-67296

FreeRDP before 3.29.0 fails to validate the maximum PDU body length in its RDPEI (RDP input extension) server channel handler before allocating a stream, enabling memory exhaustion. A malicious RDP client can connect to a FreeRDP-based RDP server and send a header-only RDPEI message declaring an oversized body length, forcing the server to allocate excessive memory and crash or stall the service. An attacker gains unauthenticated remote denial of service with no confidentiality or integrity impact, per the CVSS 4.0 vector (VA:H only). All FreeRDP releases prior to 3.29.0 are affected, but only deployments acting as RDP servers that accept connections from untrusted clients (e.g., shadow server, products embedding FreeRDP server libraries) are realistically exposed. No exploitation has been reported in the wild and the flaw is absent from CISA KEV; a public vendor security advisory (GHSA-jm8r-22j6-4m4v) exists and EPSS is low at 0.3%.

What to do: Upgrade FreeRDP to 3.29.0 or later, or install vendor/distribution backported packages. Operators running FreeRDP-based RDP servers (e.g., freerdp-shadow or products embedding the server libraries) should restrict RDP listener exposure with firewall rules or VPN access and watch for memory-exhaustion crashes. Verify the deployed version via package changelogs or 'freerdp --version' to confirm the fix is present.