This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-67296 →

DEBIAN-CVE-2026-67296

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length be...

Original description

The description as published by the source.

FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freerdp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org