Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-01 | 2 | Disclosure2 |
| 2026-08-02 | 1 | Patch1 |
CVE-2026-67292 FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong repl… https://www.cve.org/CVERecord?id=CVE-2026-67292
Post summary
The post announces a buffer over-disclosure flaw in FreeRDP versions prior to 3.29.0 that impacts the gateway WebSocket transport.
FreeRDP versions before 3.29.0 contain a CVSS 9.3 WebSocket gateway flaw. Update to 3.29.0 if your environment uses FreeRDP. https://nvd.nist.gov/vuln/detail/CVE-2026-67292 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/VdCJiq4DoH
Post summary
The tweet alerts users that FreeRDP versions before 3.29.0 are vulnerable to a CVSS 9.3 WebSocket gateway flaw and urges them to upgrade to version 3.29.0.
🚨*CVE* CVE-2026-67292 FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong repl… https://www.cve.org/CVERecord?id=CVE-2026-67292 ----- Traducción: CVE-2026-67292 Fre… http://infoflow.cloud`
Post summary
The post announces a new FreeRDP vulnerability, sharing basic technical details but no evidence of exploitation, PoC, or remediation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freerdp | freerdp | - | - | - |