CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.29.0 are vulnerable to a buffer over-disclosure issue in the WebSocket transport, which can lead to unintended data exposure through the client's Pong reply. An attacker controlling a malicious gateway or WebSocket peer can exploit this vulnerability to receive sensitive information or cause a denial of service by sending a zero-length Ping. Organizations using FreeRDP should prioritize patching to mitigate the risk of data leakage and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport (libfreerdp/core/gateway/websocket.c). The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious gateway/WebSocket peer sending a non-empty Ping control frame causes the client to reply with an overlong Pong that discloses bytes beyond the received payload (the peer receives the masking key and can unmask the reply). A zero-length Ping reaches an assertion and terminates the client (denial of service).