FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length… (CVE-2026-67296)
FreeRDP versions prior to 3.29.0 have a denial of service vulnerability in the RDPEI server channel handler. The vulnerability arises because the handler does not validate the maximum PDU body length before allocating memory. A malicious RDP client can exploit this by sending a header-only RDPEI message with a large declared body length, causing excessive memory allocation and potential service disruption.
AI Analysis
Technical Summary
CVE-2026-67296 describes a denial of service vulnerability in FreeRDP before version 3.29.0. The RDPEI server channel handler fails to validate the maximum Protocol Data Unit (PDU) body length prior to stream allocation. This allows a malicious Remote Desktop Protocol (RDP) client to send a crafted header-only RDPEI message with an artificially large declared body length, forcing the server to allocate excessive memory. This can lead to resource exhaustion and denial of service conditions on the affected server.
Potential Impact
The vulnerability can cause a denial of service by forcing the server to allocate excessive memory, potentially leading to service crashes or unavailability. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting the ease of exploitation (network vector, no privileges or user interaction required) and the significant availability impact.
Mitigation Recommendations
A fix is available in FreeRDP version 3.29.0. Users should upgrade to version 3.29.0 or later to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version information in the description. No alternative mitigations are indicated.
FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length… (CVE-2026-67296)
Description
FreeRDP versions prior to 3.29.0 have a denial of service vulnerability in the RDPEI server channel handler. The vulnerability arises because the handler does not validate the maximum PDU body length before allocating memory. A malicious RDP client can exploit this by sending a header-only RDPEI message with a large declared body length, causing excessive memory allocation and potential service disruption.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67296 describes a denial of service vulnerability in FreeRDP before version 3.29.0. The RDPEI server channel handler fails to validate the maximum Protocol Data Unit (PDU) body length prior to stream allocation. This allows a malicious Remote Desktop Protocol (RDP) client to send a crafted header-only RDPEI message with an artificially large declared body length, forcing the server to allocate excessive memory. This can lead to resource exhaustion and denial of service conditions on the affected server.
Potential Impact
The vulnerability can cause a denial of service by forcing the server to allocate excessive memory, potentially leading to service crashes or unavailability. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting the ease of exploitation (network vector, no privileges or user interaction required) and the significant availability impact.
Mitigation Recommendations
A fix is available in FreeRDP version 3.29.0. Users should upgrade to version 3.29.0 or later to remediate this vulnerability. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version information in the description. No alternative mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xq3v-xj62-r99v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67296"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6e6296bf32cb7a344f69eb
Added to database: 08/01/2026, 21:18:14 UTC
Last enriched: 08/01/2026, 21:22:52 UTC
Last updated: 08/02/2026, 00:03:47 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.