Infinite Loop Vulnerability in FreeRDP by FreeRDP

CVE-2026-109941

What is CVE-2026-109941?

FreeRDP prior to version 3.32.0 exhibits an infinite loop vulnerability within the http_chunked_read function. This flaw can be exploited by malicious RD Gateways that send incomplete chunked responses, leading to client hang-ups. Attackers can trigger this issue by supplying a partial chunk-size line or footer, followed by a clean TLS shutdown, which results in zero-byte reads that loop indefinitely. This can severely impact client performance and disrupt user experience.

References