{"id":"CVE-2026-121959","kind":"vulnerability","aliases":["CVE-2026-121959"],"related":[],"title":"FreeRDP: malicious RD Gateway can make clients spin and consume CPU","description":"FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.","summary":"FreeRDP's WebSocket reader can enter an infinite loop when a truncated frame is followed by a TLS close_notify. A malicious RD Gateway can make a client thread spin and consume CPU until the process is killed.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","rd-gateway","remote-desktop","runtime"],"not_affected_if":["freerdp-3.32.2-or-later","no-rd-gateway"],"how_to_check":"- Check the FreeRDP version in use: `xfreerdp /version` or the version of the installed FreeRDP package\n- Look for applications that link FreeRDP and connect through an RD Gateway","fix":"- FreeRDP: upgrade to `3.32.2` or later","status":"open","published_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","triaged_at":"2026-11-04T16:28:54+00:00","updated_at":"2026-11-04T16:28:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T16:28:54Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: upgrade to `3.32.2` or later","reach":"network","title":"FreeRDP: malicious RD Gateway can make clients spin and consume CPU","impact":"low","summary":"FreeRDP's WebSocket reader can enter an infinite loop when a truncated frame is followed by a TLS close_notify. A malicious RD Gateway can make a client thread spin and consume CPU until the process is killed.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["freerdp","remote-desktop","rd-gateway"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"a client thread spins and consumes CPU until killed","analyst_note":"","how_to_check":"- Check the FreeRDP version in use: `xfreerdp /version` or the version of the installed FreeRDP package\n- Look for applications that link FreeRDP and connect through an RD Gateway","plain_action":"","needs_analyst":false,"not_affected_if":["no-rd-gateway","freerdp-3.32.2-or-later"],"who_is_affected":"Clients that connect to Remote Desktop Gateways over WebSocket using FreeRDP before 3.32.2 are exposed, since the malicious server is the trigger. Systems that do not use an RD Gateway through FreeRDP's WebSocket transport are not exposed. The sources do not say whether any particular distribution has backported a fix.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4181,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121959':14A,17A '-2026':13A,16A '3.32.2':66C 'bio':82C 'caus':103C 'client':7A,53B,105C 'close':44B,101C 'consum':10A,57B,110C 'contain':67C 'context':74C 'cpu':11A,58B,111C 'cve':12A,15A 'desktop':24B 'enter':31B 'fail':77C 'follow':40B,97C 'frame':38B,96C 'freerdp':1A,18B,26B,64C 'gateway':4A,21B,49B,90C 'handl':79C 'infinit':33B,69C 'kill':63B,113C 'loop':34B,70C 'make':6A,51B 'malici':2A,47B,88C 'notifi':45B,102C 'outstand':86C 'payload':85C 'process':61B 'rd':3A,20B,48B,89C 'rd-gateway':19B 'read':75C 'reader':29B 'remot':23B 'remote-desktop':22B 'result':83C 'runtim':25B 'send':92C 'spin':8A,55B,108C 'thread':54B,106C 'tls':43B,100C 'truncat':37B,94C 'vulner':71C 'websocket':28B,73C,95C 'zero':81C","nicknames":[],"mitigations":[],"who_affected":"Clients that connect to Remote Desktop Gateways over WebSocket using FreeRDP before 3.32.2 are exposed, since the malicious server is the trigger. Systems that do not use an RD Gateway through FreeRDP's WebSocket transport are not exposed. The sources do not say whether any particular distribution has backported a fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","rdgateway","remotedesktop","runtime"],"campaign_type":null,"first_public_at":"2026-10-20T17:10:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121959","severity":null,"published_at":"2026-11-04T16:17:48+00:00","modified_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:14+00:00","fetched_at":"2026-11-04T16:28:14+00:00","note":null}],"documents":[{"id":68491,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x26g-fp9v-c2pg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:10:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68492,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-infinite-loop-via-truncated-websocket-frame","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}