Vulnerability in Freerdp
CVE-2026-67289
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (37.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.004 · change: -0.003
Affected products
- Freerdp — versions 0, 3.29.0
Weakness classification (CWE)
References
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm (Exploit, vendor-advisory, Mitigation, Vendor Advisory)
- github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f (Patch, patch)
- www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-re… (Patch, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-67289?
- CVE-2026-67289 is a critical-severity vulnerability in Freerdp, classified under HTTP Response Splitting. CVSS score: 9.8/10. Published 2026-08-01.
- How severe is CVE-2026-67289?
- Critical severity. CVSS v3 base score is 9.8 out of 10.