CVE-2026-67292

The record

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).

Affected packages

Related vulnerabilities

• CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged… CWE-130
• CVE-2026-5706 In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger… CWE-130
• CVE-2026-71402 An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. CWE-130
• CVE-2026-81575 If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts… CWE-130
• CVE-2026-58097 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation… CWE-130
• CVE-2026-58096 LcpDecodeConfig() did not validate the length of received endpoint discriminator options… CWE-130
• CVE-2026-14587 Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way… CWE-130
• CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the… CWE-130