FreeRDP EUVD-2026-102554

Exploitation requires that the victim's FreeRDP client (any version before 3.32.0) connects over the websocket gateway transport through a gateway the attacker controls or can man-in-the-middle; the malicious gateway then sends a zero-length (empty payload) websocket ping frame, causing websocket_reply_pong to pass a NULL stream to websocket_reply_close and trigger an assertion failure. Limiting factors: the attacker must occupy the gateway position (not arbitrary remote attacker), only the websocket transport path is affected, and the impact is restricted to crashing the client process - there is no code execution, privilege gain, or data disclosure.

This is a client-side denial-of-service with modest real-world priority. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9 Medium) reflects network reachability with low complexity and no authentication, but impact is confined to availability (VA:L) with zero confidentiality or integrity impact - consistent with the CWE-476 NULL pointer dereference crashing a single client process. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there are no amplifying exploitation signals; exploitation status is 'no public exploit identified at time of analysis.' The most important nuance the raw CVSS understates is the attacker-position requirement: the description specifies a 'malicious gateway,' meaning the attacker must control (or MITM) the RDP gateway the victim connects through - this is not opportunistic internet-wide exploitation despite the AV:N/PR:N/UI:N vector. Net assessment: a genuine but low-urgency, low-severity availability bug, not a high-impact priority; the PR:N/UI:N vector slightly overstates realistic exploitability because it does not capture the malicious-gateway precondition.

An attacker who operates or has compromised an RDP gateway (or can MITM a victim's gateway connection) waits for a FreeRDP-based client to connect over the websocket transport, then sends a zero-length websocket ping frame. The client's websocket_reply_pong passes a NULL stream into websocket_reply_close, hitting an assertion that terminates the client process. No public exploit code was identified, but the trigger is trivial to reproduce for anyone controlling the gateway.