CVE-2026-67289 is a CRLF injection in FreeRDP 3.28.0 and earlier. The record scores it critical (9.8), while the FreeRDP advisory rates it moderate. A malicious RDP server can inject headers into the HTTP proxy request a client sends. FreeRDP 3.29.0 is the patched release.
What's affected
FreeRDP versions up to and including 3.28.0. The patched version is 3.29.0, per the GitHub advisory and the record.
The sources disagree sharply on severity. The record says CVSS 9.8 (Critical) with a network vector and no privileges. The FreeRDP GitHub advisory says Moderate. I give both because the Critical label depends on a reading of impact that the advisory does not share. The advisory states the likely impact is HTTP proxy request and header injection against a proxy configured by the client.
The weakness is CWE-113, improper neutralization of CRLF sequences in HTTP headers. According to the advisory, a server controlled RDP redirection field called TargetNetAddress is read without checking for control characters. The client then copies it into its server hostname. When the client connects through an HTTP proxy, the hostname is written straight into the proxy CONNECT request line and Host header, so line breaks in the value become new headers or requests.
How to check if you're exposed
Read the client version:
xfreerdp /version
Anything up to 3.28.0 is affected. FreeRDP is also embedded in other software, such as remote desktop clients and gateways, so check the packages that bundle it as well as the command line tool.
Then look at your setup. The advisory lists conditions: the client must use an HTTP proxy, the server must be malicious or compromised and able to send a redirection message, and the proxy has to act on the injected content. If your RDP clients never go through an HTTP proxy, the impact path does not exist for you.
What to do now
- Upgrade FreeRDP to 3.29.0 or later, including copies bundled in other applications.
- Connect only to RDP servers you trust, and be wary of redirection from third party hosts.
- If your clients use an HTTP proxy, review the proxy's handling of unusual request lines and extra headers.
- Check your Linux distribution for updated FreeRDP packages and apply them.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
CRLF injection works because a protocol like HTTP uses line breaks to separate headers. If a value that should be a hostname contains a line break, the receiver sees what looks like extra headers. The fix is to validate the hostname and reject control characters before using it.
The unusual part is the direction of trust. The client trusts a redirect from the server it connected to, and then passes its value into a request to a third party, the proxy. A bad RDP server can therefore act on the proxy through the client. The real harm depends on the proxy, which is why the severity labels differ.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is the record's score so much higher than the advisory's rating?
The record scores it 9.8 Critical. The advisory rates it Moderate and describes proxy header injection as the likely impact.
Am I affected if I do not use a proxy?
The advisory ties the impact to clients that connect through an HTTP proxy. Upgrade anyway.
Sources
Last reviewed: 18 October 2026.
