Ghostwire

CVE-2026-67296: FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to...

HIGH CVSS 7.5 Exploit Available

Published: August 1, 2026 | Last Modified: August 1, 2026

Description

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jm8r-22j6-4m4v
www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-rdpei-pdu
www.tenable.com/cve/CVE-2026-67296
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-67296