{"id":"CVE-2026-111373","kind":"vulnerability","aliases":["CVE-2026-111373"],"related":[],"title":"FreeRDP: zero-length websocket ping from a gateway crashes the client","description":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.","summary":"FreeRDP before 3.32.0 dereferences a NULL stream in its websocket transport when a gateway sends a zero-length ping. The assertion failure terminates the client process, causing a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":"< 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","package","rdp-clients","websocket-gateway"],"not_affected_if":["direct-rdp-no-websocket","fixed-3.32.0-or-later"],"how_to_check":"- Check the FreeRDP version installed with `xfreerdp --version` or `sdl-freerdp --version`, and look for versions below `3.32.0`.\n- Check whether the client connects through a websocket gateway (for example, a web-based RDP gateway).","fix":"- Upgrade FreeRDP to `3.32.0` or later.","status":"open","published_at":"2026-10-16T03:18:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:19+00:00","updated_at":"2026-10-25T03:25:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:25:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.0` or later.","reach":"network","title":"FreeRDP: zero-length websocket ping from a gateway crashes the client","impact":"low","summary":"FreeRDP before 3.32.0 dereferences a NULL stream in its websocket transport when a gateway sends a zero-length ping. The assertion failure terminates the client process, causing a denial of service.","category":"package","nicknames":[],"who_cares":["freerdp","rdp-clients","websocket-gateway"],"confidence":0.7,"needs_auth":"no","worst_case":"Client process crashes, causing denial of service","analyst_note":"","how_to_check":"- Check the FreeRDP version installed with `xfreerdp --version` or `sdl-freerdp --version`, and look for versions below `3.32.0`.\n- Check whether the client connects through a websocket gateway (for example, a web-based RDP gateway).","needs_analyst":false,"not_affected_if":["direct-rdp-no-websocket","fixed-3.32.0-or-later"],"who_is_affected":"Clients older than 3.32.0 that connect to RDP servers through a websocket gateway are exposed, because the malicious party has to be the gateway the client talks to. Direct RDP connections that do not use the websocket transport are not described as affected. Teams that only run servers or use a different FreeRDP build can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3372,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111373':15A,18A '-2026':14A,17A '3.32.0':30B,62C 'allow':74C 'assert':49B,106C 'caus':55B,114C 'client':12A,24B,53B,80C,111C 'close':103C 'contain':63C 'crash':10A,79C 'cve':13A,16A 'denial':57B,115C 'derefer':31B,67C 'failur':50B,107C 'freerdp':1A,19A,20B,28B,60C 'gateway':9A,27B,41B,77C 'length':4A,46B,85C,90C 'malici':76C 'null':33B,65C 'nullptr':98C 'packag':21B 'pass':96C 'payload':89C 'ping':6A,47B,86C 'pointer':66C 'pong':95C 'process':54B,112C 'rdp':23B 'rdp-client':22B 'repli':94C,102C 'send':42B,82C 'servic':59B,117C 'stream':34B,99C 'termin':51B,109C 'transport':38B,72C 'trigger':104C 'vulner':68C 'websocket':5A,26B,37B,71C,93C,101C 'websocket-gateway':25B 'zero':3A,45B,84C,92C 'zero-length':2A,44B,83C","nicknames":[],"mitigations":[],"who_affected":"Clients older than 3.32.0 that connect to RDP servers through a websocket gateway are exposed, because the malicious party has to be the gateway the client talks to. Direct RDP connections that do not use the websocket transport are not described as affected. Teams that only run servers or use a different FreeRDP build can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111373","severity":null,"published_at":"2026-10-16T03:18:04+00:00","modified_at":"2026-10-20T15:37:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}