MEDIUM Published November 4, 2026

CVE-2026-121959

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.

CVSS base score

6.5 (v3.1)

Severity

MEDIUM

Attack vector

Network

Weakness

CWE-835

Last modified

November 5, 2026

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

freerdp freerdp

References

github.com Exploit, Mitigation, Vendor Advisory
www.vulncheck.com Third Party Advisory
github.com Exploit, Mitigation, Vendor Advisory

View full NVD advisory →

More freerdp vulnerabilities

Published the same day

← Back to CVE watch

CVE-2026-121959

Affected products

References

More freerdp vulnerabilities

Published the same day

Related reading