CVE-2026-111373

A flaw was found in FreeRDP. A malicious gateway or remote server can trigger a Denial of Service (DoS) by sending a zero-length WebSocket ping message to a connected client. When processing this empty payload, the application encounters an invalid null memory reference, triggering an assertion failure that terminates the client process.

A moderate denial-of-service vulnerability was found in FreeRDP as shipped in Red Hat Enterprise Linux and other Red Hat offerings (including Red Hat In-Vehicle OS, Fedora, and EPEL). A malicious or compromised RD gateway or remote server can send a zero-length WebSocket ping message to a connected FreeRDP client. When processing the empty payload, the websocket transport passes a NULL stream pointer to websocket_reply_close, triggering an assertion failure and NULL pointer dereference that terminates the client process. The impact is limited to availability of the client process: there is no impact on confidentiality or integrity, and no code execution (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), consistent with the upstream severity rating. The affected Red Hat product streams list freerdp/freerdp2 as affected, with the fix deferred to a future update; the residual risk while the fix is deferred is that a remote attacker able to impersonate or control a gateway can repeatedly crash FreeRDP clients and disrupt active remote desktop sessions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.