FreeRDP CVE-2026-109941

Exploitation requires the FreeRDP client to connect through an RD Gateway (HTTP transport) that is attacker-controlled, compromised, or subject to a man-in-the-middle; the malicious server sends an incomplete chunked response - a partial chunk-size line or footer - followed by a clean TLS shutdown, triggering the zero-byte-read infinite loop in http_chuncked_read. Limiting factors: the victim must actively initiate the gateway connection (UI:P/UI:R), the attacker must sit at the gateway endpoint rather than attack an arbitrary internet host, and only clients using the RD Gateway HTTP path on FreeRDP 2.3.0 through 3.31.x are affected. Impact is confined to hanging the client decoder thread (availability only); there is no code execution, data exposure, or server-side effect.

This is a client-side denial-of-service in FreeRDP (CWE-835, infinite loop). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 7.1 and is internally consistent with the description: no confidentiality or integrity impact (VC:N/VI:N), only availability (VA:H), and passive user interaction (UI:P) because the victim client must initiate a connection to the malicious RD Gateway. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals here do not justify emergency prioritization. The key nuance is that PR:N is accurate from the attacker's perspective (the gateway needs no credentials to send a malformed response), but exploitation is NOT unauthenticated remote code execution against a listening service: it requires the attacker to operate or compromise the RD Gateway the client connects to, or to MITM that TLS session. Impact is limited to freezing the client decoder thread - a hang/freeze, not a crash with persistence or lateral movement. Net: a genuine but moderate availability issue, appropriately rated in the high band rather than critical, and best treated as patch-on-cycle unless the environment routes RDP through untrusted gateways.

A user launches an RDP session through an RD Gateway that an attacker controls, has compromised, or can MITM. The malicious gateway sends a partial chunk-size line or footer and then cleanly closes the TLS connection, driving http_chuncked_read into a zero-byte-read loop that hangs the FreeRDP client's decoder thread indefinitely. No public exploit code was identified at time of analysis, but the attack is simple to reproduce for anyone operating the gateway endpoint.