UBUNTU-CVE-2026-121959: High severity ubuntu/freerdp vulnerability

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until killed.

Affected Software

2 affected components

ubuntu/freerdp*

Event History

Nov 4, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP clients running a version before 3.32.2 are exposed when they connect to an RD Gateway that can deliver malicious WebSocket traffic. The issue affects the client thread rather than the gateway itself.

What must an attacker do to trigger the denial of service?

The attacker needs to control or impersonate an RD Gateway that the client connects to. They can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until it is killed.

What should be done if updating is not immediately possible?

Avoid connecting affected FreeRDP clients to untrusted RD Gateways until they can be updated. Update FreeRDP to version 3.32.2 or later when possible.

How can I identify potentially affected systems?

Identify systems using FreeRDP versions earlier than 3.32.2, especially clients configured to use RD Gateways over WebSocket transport. Affected activity may present as a FreeRDP client thread consuming CPU continuously after a gateway connection is terminated.

UBUNTU-CVE-2026-121959: High severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

What should be done if updating is not immediately possible?

How can I identify potentially affected systems?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

What should be done if updating is not immediately possible?

How can I identify potentially affected systems?