The vulnerability in FreeRDP occurs in the gateway WebSocket transport where the client reuses a fixed 1024-byte Pong response regardless of the actual Ping payload length. A malicious gateway can send a Ping control frame with a payload larger than the buffer, causing the client to return an overlong Pong that leaks bytes beyond the intended data. This over-disclosure allows the attacker to retrieve arbitrary memory contents from the client. A zero-length Ping triggers an assertion and results in a denial of service. The flaw is a Buffer Over-Read (CWE‑130) that can compromise confidentiality and disrupt client availability.

All FreeRDP installations running a version earlier than 3.29.0, particularly those using the gateway WebSocket transport module. The issue is present in the libfreerdp/core/gateway/websocket.c component across all platforms supported by FreeRDP.

The CVSS score of 9.3 indicates a critical severity. Although the EPSS score is reported as < 1%, and the vulnerability is not listed in the CISA KEV catalog, the attack requires a malicious WebSocket gateway to which the client connects. If an attacker controls or compromises a gateway, they can inject crafted Ping frames to trigger the overlong Pong reply, thereby exposing client memory. A zero-length Ping causes an assertion and terminates the client, creating a denial of service. The risk remains high until a patch is applied.