CVE-2026-67289: critical vulnerability in FreeRDP
FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.4%
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
FreeRDP · FreeRDPRelated CVEs — FreeRDP
In the same product, most dangerous first.
CVE-2026-45700HIGHHeap-buffer-overflow write in planar bitmap decoderEPSS 6.1%CVE-2026-44420HIGHFreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSEPSS 4.6%CVE-2024-32459CRITICALFreeRDP Out-Of-Bounds Read in ncrush_decompressEPSS 3.7%CVE-2022-24882CRITICALServer side NTLM does not properly check parameters in FreeRDPEPSS 2.8%CVE-2022-24883HIGHFreeRDP Server authentication might allow invalid credentials to passEPSS 2.3%CVE-2020-11019MEDIUMOut of bound read in update_recv in FreeRDPEPSS 2.3%