CVE-2026-67292

A flaw was found in FreeRDP, a remote desktop protocol client. A malicious server or WebSocket peer could send a specially crafted Ping control frame. This could cause the client to send an overly long Pong reply, leading to the disclosure of sensitive information beyond the intended payload. Additionally, sending a zero-length Ping could trigger an assertion, causing the client to terminate and resulting in a denial of service.

This issue is classified as Moderate severity because successful exploitation requires a user to connect to a malicious gateway or server, where a crafted Ping control frame can trigger a client memory disclosure or cause an application crash leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid connecting to untrusted RDP gateways when using FreeRDP. This flaw specifically affects the client when interacting with a malicious gateway, which can exploit the WebSocket transport to trigger information disclosure or a denial of service.