CVE-2026-111373 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process and causes denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical reliability flaw within its WebSocket transport implementation, specifically affecting how the application handles control frames during active connections. This issue manifests as a NULL pointer dereference that occurs when the client receives specific malformed input from an adversary-controlled gateway or server. The root cause lies in the websocket_reply_pong function, which is responsible for processing incoming ping messages and generating appropriate pong responses to maintain connection liveness. Under normal operational conditions, this routine expects valid data streams to facilitate communication. However, when a malicious actor sends zero-length pings, the internal logic fails to validate the payload length before proceeding with stream operations. Consequently, the function attempts to pass a null pointer representing an empty or non-existent stream object directly into websocket_reply_close. This invalid memory access triggers an assertion failure within the application runtime environment, resulting in the immediate termination of the FreeRDP client process and causing a denial of service for legitimate users relying on that session.
From a technical perspective, this flaw aligns with CWE-476, which describes NULL Pointer Dereference vulnerabilities where software fails to check if an object is null before using it as a pointer. The attack vector requires the adversary to act as a man-in-the-middle or control the remote gateway server, allowing them to inject crafted WebSocket frames into the communication channel. By exploiting this condition, the attacker can reliably crash any connected FreeRDP client without requiring authentication in many configurations, effectively disrupting access to remote desktop resources. This behavior is consistent with techniques observed in ATT&CK tactic TA0040, specifically under technique T1499 Endpoint Denial of Service, where adversaries aim to degrade or disrupt the availability of system components through resource exhaustion or application crashes rather than compromising confidentiality or integrity directly.
The operational impact of this vulnerability extends beyond simple service interruption for individual users. In enterprise environments utilizing FreeRDP as a gateway solution or client interface, such instability can lead to significant productivity losses and potential security gaps if automated failover mechanisms are not robustly configured. Furthermore, the predictability of the crash mechanism makes it an attractive target for persistent denial-of-service campaigns aimed at disrupting remote work infrastructure. Mitigation strategies primarily involve upgrading to FreeRDP version 3.32.0 or later, where developers have implemented proper input validation checks within the websocket_reply_pong function to ensure that stream objects are not null before being passed to downstream functions like websocket_reply_close. Additionally, network-level defenses such as WebSocket-aware firewalls can be configured to inspect and filter out malformed control frames with zero-length payloads, providing an additional layer of protection against exploitation attempts while patching is applied across the infrastructure.