CVE-2026-121959
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a client thread to spin and consume CPU until killed.