CVE-2026-121959 in FreeRDP
Summary
by MITRE • 11/04/2026
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a significant availability risk stemming from improper input validation within the websocket_context_read function. This flaw is categorized under CWE-835, which describes loops with unreachable exit conditions or infinite looping scenarios where the application fails to properly handle edge cases in data processing logic. The core technical issue arises when the underlying BIO layer returns a zero result indicating no more bytes are available for reading, yet there remains outstanding payload data that has not been fully processed by the WebSocket frame parser. In normal operation, this state should trigger an error condition or graceful termination of the read loop; however, in affected versions, the logic incorrectly interprets this combination as valid progress and continues to iterate without advancing the buffer pointer or breaking out of the cycle.
This specific flaw can be exploited remotely by a malicious Remote Desktop Protocol Gateway server acting as an intermediary between the FreeRDP client and the target remote desktop session. By carefully crafting network traffic, an attacker can send a truncated WebSocket frame that signals incomplete data transmission but leaves residual payload bytes in the buffer state. Immediately following this malformed frame, the attacker sends a TLS close_notify alert to signal the end of the secure connection. The interaction between these two elements creates the exact condition required to trigger the infinite loop: the BIO layer reports zero availability due to the closure, while the WebSocket context still perceives outstanding payload data that needs processing. Because neither side acknowledges completion or errors out correctly, the client thread enters a tight execution cycle that consumes one hundred percent of a CPU core indefinitely.
The operational impact of this vulnerability is primarily focused on service denial and resource exhaustion rather than confidentiality or integrity compromise. When triggered, the affected FreeRDP process becomes unresponsive as its primary processing thread spins continuously without yielding control to other system tasks. This results in high CPU utilization that can degrade performance for other applications running on the same host machine. In multi-user environments where multiple RDP sessions are maintained simultaneously, a single successful exploitation attempt against one session could lead to cascading resource contention if not isolated properly by operating system limits. Ultimately, the only way to restore normal functionality is for an administrator or user to manually terminate the hung FreeRDP process through task management tools, leading to disruption of remote work activities and potential loss of unsaved data within the remote application sessions.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary defense is upgrading to FreeRDP version 3.32.2 or later, where this logic error has been corrected by ensuring that a zero BIO result with outstanding payload correctly triggers an error return path rather than continuing the read loop. Organizations should also implement network-level access controls to restrict connections from untrusted RD Gateway servers and monitor for anomalous CPU usage patterns associated with RDP client processes. From a defensive engineering perspective, this incident highlights the importance of rigorous state machine validation in protocol parsers, particularly when handling partial data transfers across secure transport layers like TLS. Adhering to CWE-835 guidelines during code review can help prevent similar infinite loop vulnerabilities in other network-facing applications that process streaming protocols over encrypted channels.