CVE-2026-67292

Katalog CVE

CVSS 6.5 · Medium EPSS 0,48%

Kerentanan Improper Handling of Length Parameter Inconsistency pada freerdp. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-130: Improper Handling of Length Parameter Inconsistency

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8v6m-2cmc-chx9 exploit · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f patch
• https://www.vulncheck.com/advisories/freerdp-before-websocket-ping-buffer-over-disclosure patch · advisory pihak ketiga