NVD security advisoryHigh
High advisory for FreeRDP
CVE-2026-121959 · Reported 4 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
FreeRDPAffected product
Advisory overview
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.