FreeRDP prior to version 3.32.2 contains a flaw in the websocket_context_read routine that fails to handle a zero BIO result when the client has a pending payload. A malicious Remote Desktop Gateway can send a truncated WebSocket frame followed by a TLS close_notify. The client thread then enters an endless loop, consuming all available CPU until the process is terminated. The weakness is characterized as an infinite loop (CWE‑835) and can lead to complete service disruption on the target system.

The affected product is FreeRDP:FreeRDP. All releases before 3.32.2 are vulnerable. The problem is present in the core client library used by any deployment of FreeRDP that accepts WebSocket connections.

The CVSS score of 7.1 indicates a high impact and moderate exploit difficulty. The EPSS score is not available, so no quantitative likelihood can be stated, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a remote attacker who can control the RD Gateway or otherwise inject WebSocket frames. Because the flaw causes a continuous CPU‑bound loop, a successful exploitation results in a denial of service condition that requires the victim process to be killed or the host to be rebooted.