The vulnerability in FreeRDP prior to version 3.29.0 exists in the gateway WebSocket transport implementation (libfreerdp/core/gateway/websocket.c). When responding to a Ping control frame, the client reuses a fixed 1024-byte buffer for the Pong reply without properly limiting the response length to the actual Ping payload size. This allows a malicious gateway or WebSocket peer to receive an overlong Pong response containing unintended memory disclosure, including the masking key used for unmasking. Furthermore, sending a zero-length Ping frame causes an assertion failure, crashing the client and resulting in denial of service. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, no privileges or user interaction required, with limited confidentiality impact and low availability impact.

An attacker controlling the gateway or WebSocket peer can cause the FreeRDP client to disclose memory beyond the expected Pong payload, potentially leaking sensitive information. Additionally, the attacker can send a zero-length Ping frame to crash the client, causing denial of service. There is no indication of integrity compromise or code execution from this vulnerability.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the FreeRDP project advisories for updates addressing this issue. Until a fix is available, avoid connecting to untrusted or potentially malicious gateways or WebSocket peers to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.