CVE-2026-111373
Description
A flaw was found in FreeRDP. A malicious gateway or remote server can trigger a Denial of Service (DoS) by sending a zero-length WebSocket ping message to a connected client. When processing this empty payload, the application encounters an invalid null memory reference, triggering an assertion failure that terminates the client process.
Statement
A moderate denial-of-service vulnerability was found in FreeRDP as shipped in Red Hat Enterprise Linux and other Red Hat offerings (including Red Hat In-Vehicle OS, Fedora, and EPEL). A malicious or compromised RD gateway or remote server can send a zero-length WebSocket ping message to a connected FreeRDP client. When processing the empty payload, the websocket transport passes a NULL stream pointer to websocket_reply_close, triggering an assertion failure and NULL pointer dereference that terminates the client process. The impact is limited to availability of the client process: there is no impact on confidentiality or integrity, and no code execution (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream severity rating. The affected Red Hat product streams list freerdp/freerdp2 as affected, with the fix deferred to a future update; the residual risk while the fix is deferred is that a remote attacker able to impersonate or control a gateway can repeatedly crash FreeRDP clients and disrupt active remote desktop sessions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 7.5 | 5.3 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
