CVE-2026-121959: FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

Q: Who is exposed to this issue?

FreeRDP clients using affected versions before 3.32.2 are exposed when they connect through an RD Gateway that can send malicious WebSocket traffic. The vulnerable components are listed for Debian freerdp2 and freerdp3 packages.

Q: What does an attacker need to exploit it?

An attacker needs to control or impersonate an RD Gateway used by the client, or otherwise be able to make that gateway send a truncated WebSocket frame followed by a TLS close_notify. No client privileges are required, but user interaction is required for the client to connect.

Q: What is the impact of successful exploitation?

The affected client thread can enter an infinite loop and consume CPU until it is killed. The provided severity vector indicates an availability impact only, with no stated confidentiality or integrity impact.

Q: How can this be remediated?

Update FreeRDP to version 3.32.2 or later. If updating is not immediately possible, avoid connecting affected clients to untrusted RD Gateways.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until killed.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients using affected versions before 3.32.2 are exposed when they connect through an RD Gateway that can send malicious WebSocket traffic. The vulnerable components are listed for Debian freerdp2 and freerdp3 packages.

What does an attacker need to exploit it?

An attacker needs to control or impersonate an RD Gateway used by the client, or otherwise be able to make that gateway send a truncated WebSocket frame followed by a TLS close_notify. No client privileges are required, but user interaction is required for the client to connect.

What is the impact of successful exploitation?

The affected client thread can enter an infinite loop and consume CPU until it is killed. The provided severity vector indicates an availability impact only, with no stated confidentiality or integrity impact.

How can this be remediated?

Update FreeRDP to version 3.32.2 or later. If updating is not immediately possible, avoid connecting affected clients to untrusted RD Gateways.

CVE-2026-121959: FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated?