PT-2026-67269 · Freerdp · Freerdp

1121984919 · CVE-2026-67289 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description Insufficient validation of CRLF and control characters occurs in the server-controlled RDP redirection TargetNetAddress field. This value is assigned to the client's ServerHostname and is subsequently written into the proxy CONNECT request line and Host header by the http proxy connect() function without filtering when connecting through an HTTP proxy. A compromised or malicious RDP server can send a crafted redirection PDU (Protocol Data Unit) containing embedded control characters to inject arbitrary headers or requests into the HTTP proxy CONNECT request.

Recommendations Update FreeRDP to version 3.29.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-67289

GHSA-MWWH-MHP9-Q7VM

Affected Products

Freerdp

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67289.json · Exploit
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-67289 · Security Note
• https://osv.dev/vulnerability/CVE-2026-67289 · Vendor Advisory
• https://vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection · Note