CVE-2026-121959FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

Beschreibung

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-x26g-fp9v-c2pg) vendor-advisoryExploitMitigationVendor Advisory
• VulnCheck Advisory: FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame third-party-advisoryThird Party Advisory