CVE-2026-67289: CRLF Injection Vulnerability in FreeRDP

FreeRDP versions 3.28.0 and earlier contain a critical vulnerability (CVE-2026-67289) stemming from improper validation of CRLF and control characters within the TargetNetAddress field during RDP redirection. When a client is configured to connect via an HTTP proxy, FreeRDP propagates the attacker-controlled input directly into the proxy CONNECT request line and Host header. This flaw enables an attacker operating a malicious RDP server to execute HTTP request smuggling, inject arbitrary HTTP headers, or potentially facilitate further attacks against the proxy infrastructure or the client's internal network traversal. Because the proxy processes these smuggled requests as authenticated or authorized traffic, the impact can include unauthorized resource access or secondary exploitation. Defenders should prioritize updating to FreeRDP 3.29.0 or later to ensure proper sanitization of redirection payloads.

Impact

Successful exploitation allows for HTTP request smuggling and header injection through the proxy, which could lead to unauthorized access to internal resources, credential theft, or bypass of proxy-based security controls. This vulnerability affects all environments using FreeRDP as a client when egressing through an HTTP proxy, regardless of the underlying operating system.

Recommendation

• Upgrade all FreeRDP client installations to version 3.29.0 or later immediately to apply the required input sanitization for the TargetNetAddress field.
• Review HTTP proxy logs for anomalous CONNECT requests that contain unexpected control characters or header structure deviations.
• Evaluate the necessity of allowing HTTP proxy connections for RDP traffic, and consider transitioning to direct connections or hardened VPN-based access where possible.