Is CVE-2026-121959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121959 being exploited in the wild.

How severe is CVE-2026-121959?

Medium severity, with a CVSS score of 6.5, published 4 November 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP before 3.32.2.

Is there a fix for CVE-2026-121959?

Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121959 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121959?

Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121959: FreeRDP infinite loop in WebSocket frame handling

CVE-2026-121959 · Severity: medium · CVSS 6.5 · Published 2026-11-04

FreeRDP is a remote desktop client used to connect to Windows systems over the network. A malicious RD Gateway server can send a truncated WebSocket frame that causes the FreeRDP client to enter an infinite loop, consuming CPU resources until the application is forcibly terminated. While this does not directly expose data or compromise the system, it creates a denial-of-service condition that prevents legitimate remote desktop connections.

Technologies: FreeRDP Project FreeRDP. Vendors: FreeRDP Project.

Quick answers

Is CVE-2026-121959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121959 being exploited in the wild.
How severe is CVE-2026-121959?: Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP before 3.32.2.
Is there a fix for CVE-2026-121959?: Yes: fixed in 3.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121959 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121959?: Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.2

Technical details

The vulnerability exists in websocket_context_read in libfreerdp/core/gateway/websocket.c, which fails to handle a zero return value from websocket_read_data when outstanding payload remains. A malicious RD Gateway can send a partial WebSocket frame (declaring a 5-byte payload but supplying only 2 bytes) followed by a TLS close_notify, causing the BIO to return EOF repeatedly. The client thread loops indefinitely attempting to read the missing payload without state change or exit condition.

Affected products

FreeRDP Project FreeRDP before 3.32.2

Timeline

2026-10-20: disclosed
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.