CVE-2026-121959 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeRDP's WebSocket reader can enter an infinite loop when a truncated frame is followed by a TLS close_notify. A malicious RD Gateway can make a client thread spin and consume CPU until the process is killed.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Clients that connect to Remote Desktop Gateways over WebSocket using FreeRDP before 3.32.2 are exposed, since the malicious server is the trigger. Systems that do not use an RD Gateway through FreeRDP's WebSocket transport are not exposed. The sources do not say whether any particular distribution has backported a fix.
Not affected if freerdp-3.32.2-or-later, no-rd-gateway
Who cares freerdp, rd-gateway, remote-desktop
xfreerdp /version or the version of the installed FreeRDP package3.32.2 or laterFreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.
This page as .md · .json · in your agent: get_signal("CVE-2026-121959") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.