CVE-2026-111373 Overview
CVE-2026-111373 is a NULL pointer dereference vulnerability in FreeRDP versions before 3.32.0. The flaw resides in the websocket transport layer, where a malicious Remote Desktop Gateway can send zero-length ping frames to crash connected clients. When the payload length is zero, the websocket_reply_pong function passes a nullptr stream to websocket_reply_close, triggering an assertion failure that terminates the client process. The result is a denial-of-service condition against FreeRDP clients that connect through an attacker-controlled gateway. The vulnerability is tracked under CWE-476 and affects deployments relying on FreeRDP for RDP connectivity through WebSocket-capable gateways.
Critical Impact
A malicious gateway can crash FreeRDP clients remotely by transmitting a single zero-length WebSocket ping, with no authentication or user interaction required.
Affected Products
- FreeRDP versions prior to 3.32.0
- Applications and distributions bundling FreeRDP client libraries
- WebSocket-based RDP gateway client deployments
Discovery Timeline
- 2026-10-16 - CVE-2026-111373 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-111373
Vulnerability Analysis
The vulnerability affects FreeRDP's WebSocket transport, which encapsulates RDP traffic over HTTP/WebSocket connections commonly used with Remote Desktop Gateways. FreeRDP processes incoming control frames including PING messages, responding according to the WebSocket protocol defined in RFC 6455. The defective code path handles zero-length ping payloads incorrectly, converting a benign protocol message into a client-side crash. Because the attack originates from the gateway endpoint, any client that negotiates a WebSocket transport with a hostile or compromised gateway is exposed. The impact is limited to availability; confidentiality and integrity are not affected.
Root Cause
The root cause is missing validation of the payload length before dereferencing the payload stream pointer. When a WebSocket ping arrives with zero payload length, websocket_reply_pong forwards a nullptr stream argument to websocket_reply_close. The downstream function assumes a valid stream pointer and triggers an assertion failure, which aborts the process. This is a classic CWE-476 NULL pointer dereference caused by failure to handle an edge case in protocol parsing.
Attack Vector
Exploitation requires the victim to establish a WebSocket-tunneled RDP session with a gateway controlled by the attacker, or with a legitimate gateway subject to man-in-the-middle interference. After the WebSocket handshake, the attacker sends a WebSocket PING frame with a zero-length payload. The FreeRDP client parses the frame, calls websocket_reply_pong, and crashes on the resulting null-stream assertion. The vulnerability is network-reachable and requires no authentication or user interaction beyond initiating the RDP connection. See the GitHub Security Advisory GHSA-83g2-gf92-5c4g and the VulnCheck FreeRDP Null Dereference Advisory for additional technical context.
Detection Methods for CVE-2026-111373
Indicators of Compromise
- Unexpected FreeRDP client process termination with assertion failure messages referencing websocket_reply_close or stream handling.
- Core dumps or crash telemetry from xfreerdp, wlfreerdp, or applications embedding FreeRDP shortly after WebSocket gateway negotiation.
- Repeated short-lived WebSocket sessions originating from clients toward a single untrusted gateway host.
Detection Strategies
- Inventory endpoints and software distributions for FreeRDP versions earlier than 3.32.0 using software asset management tooling.
- Inspect WebSocket traffic to RDP gateways for PING control frames (opcode 0x9) with a payload length of zero.
- Correlate RDP gateway connection events with subsequent process crash events on client hosts to identify suspicious patterns.
Monitoring Recommendations
- Enable crash reporting on endpoints running FreeRDP-based clients and alert on repeated terminations following RDP session initiation.
- Monitor outbound connections to RDP gateway infrastructure and flag connections to unapproved or newly observed gateway hostnames.
- Log WebSocket handshake details, including Sec-WebSocket-Protocol values, to support investigation of anomalous gateway behavior.
How to Mitigate CVE-2026-111373
Immediate Actions Required
- Upgrade FreeRDP to version 3.32.0 or later across all endpoints, servers, and bundled applications.
- Audit third-party software that embeds FreeRDP libraries and apply vendor updates that incorporate the fixed version.
- Restrict RDP gateway connections to a known allowlist of trusted gateway hosts enforced at the network perimeter.
Patch Information
The FreeRDP project resolved the vulnerability in release 3.32.0 by adding payload length validation in the WebSocket pong reply path. Refer to the GitHub Security Advisory GHSA-83g2-gf92-5c4g for patch details and backport guidance. Linux distributions and downstream packagers should rebuild dependent packages against the patched release.
Workarounds
- Disable WebSocket transport for RDP clients where feasible and fall back to native RDP over TCP for internal connections.
- Route RDP gateway traffic through a reverse proxy that validates WebSocket control frames and drops malformed PING messages.
- Isolate hosts that must use FreeRDP with untrusted gateways in a segmented network to limit operational impact from crashes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
