CVE-2026-109250: Improper Validation of Array Index

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...