All vulnerabilities
GHSA-83g2-gf92-5c4g

FreeRDP: websocket transport NULL dereference on zero length ping

FreeRDP
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.32.0Fixed versionGitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

FreeRDP based clients crash with a NULL dereference if the gateway sends a websocket ping with 0 length.

Details

websocket_reply_pong calls websocket_reply_close with nullptr as stream parameter

WebSocket Ping
      |
      | payloadLength == 0
      v
websocket_reply_pong()
      |
      | zero-position response stream
      v
websocket_reply_close(..., nullptr)
      |
      v
websocket_context_write_wstream(..., nullptr, ...)
      |
      v
WINPR_ASSERT(sPacket)
      |
      v
potential NULL dereference / process termination

Patches

3.32.0

Workarounds

Do not use websockets if possible. Use /gateway:transport:http,no-websockets

Text from GitHub Advisory Database

Affected versions 1

  • FreeRDP, c<= 3.31.1GitHub