← CVE index
Vulnerability record/PUBLISHED/Published Nov 4, 2026 15:33:23 UTC

CVE-2026-121959

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.

Base score7.1/ 10
SeverityHighCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityVulnCheck
Last updatedNov 4, 2026 18:28:20 UTC
PublishedNov 4, 2026 15:33:23 UTC
ReservedNov 4, 2026 12:46:55 UTC

Credits

  • Kushalkhemka
  • mayank-jangid-moon
  • opensec-intelligence