CVE-2026-111373: FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

Q: Which deployments are exposed to this denial-of-service issue?

FreeRDP clients using the WebSocket transport are exposed when connecting through a malicious gateway. The affected versions are those before 3.32.0.

Q: What must an attacker control to trigger the crash?

An attacker needs to operate or control a gateway that the FreeRDP client connects to and send a WebSocket ping with a zero-length payload. No client-side privileges or user interaction are indicated.

Q: What is the practical impact on an affected client?

The malformed zero-length ping causes an assertion failure that terminates the FreeRDP client process. The described impact is denial of service; no confidentiality or integrity impact is stated.

Published Oct 16, 2026

Updated

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an assertion failure that terminates the client process and causes denial of service.

Affected Software

1 affected component

FreeRDP freerdp<3.32.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:17 AM

Data Sourced

via MITRE·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

FreeRDP clients using the WebSocket transport are exposed when connecting through a malicious gateway. The affected versions are those before 3.32.0.

What must an attacker control to trigger the crash?

An attacker needs to operate or control a gateway that the FreeRDP client connects to and send a WebSocket ping with a zero-length payload. No client-side privileges or user interaction are indicated.

What is the practical impact on an affected client?

The malformed zero-length ping causes an assertion failure that terminates the FreeRDP client process. The described impact is denial of service; no confidentiality or integrity impact is stated.

CVE-2026-111373: FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker control to trigger the crash?

What is the practical impact on an affected client?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What must an attacker control to trigger the crash?

What is the practical impact on an affected client?