CVE-2026-109677

Versions of FreeRDP from 2.0.0-beta1 before 3.28.0 are vulnerable to an out-of-bounds read in the smartcard_LocateCardsByATRA_Call function. The root cause is that the cbAtr byte count is not capped, allowing malicious RDP servers to send crafted ATR mask arrays. Attackers can use query timing as...

CVE-2026-109678

FreeRDP versions 3.0.0-beta1 before 3.32.0 are vulnerable to a reachable assertion when built with verbose WinPR assertions and smartcard emulation enabled. The root cause is that the emulated SCardStatusA function passes a NULL reader-name destination to scard_copy_strings. A malicious RDP serve...

CVE-2026-109678

FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scardcopystrings. A malicious RDP server can send an SCardStatusA request with...

CVE-2026-109676

FreeRDP versions 3.0.0-beta1 before 3.32.0 are vulnerable to a Use-After-Free vulnerability (CWE-416) within the smartcard handling component. An attacker can trigger an invalid smartcard connect operation, which allows them to access a freed smartcard handle object. This reuse of the freed handl...

CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle,...

CVE-2026-109241

A flaw was found in FreeRDP. A malicious server can cause a Denial of Service DoS by triggering a NULL pointer dereference in the client video redirection channel. By sending messages out of sequence, specifically clearing geometry data before transmitting video data, the server causes the client...

CVE-2026-109240

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a specially crafted request with an unvalidated buffer size over the USB redirection channel. This missing bounds check triggers an internal assertion failure that immediately...

CVE-2026-109247

A flaw was found in FreeRDP's clipboard handling component. A malicious Remote Desktop Protocol RDP server can supply crafted file names containing directory traversal sequences in clipboard data. When a user pastes content into a local file manager, the client improperly resolves the path, causi...

CVE-2026-109256

A flaw was found in FreeRDP. A remote attacker acting as a malicious Remote Desktop Protocol RDP clipboard peer can cause a Denial of Service DoS by sending a specially crafted image over the clipboard channel. When the client converts the image to the PNG format, a memory reallocation failure...

CVE-2026-109253

A flaw was found in FreeRDP. When processing authentication data for Remote Credential Guard, the client checks data lengths before accounting for byte alignment padding. A malicious or compromised Remote Desktop Protocol RDP server can exploit this flaw by sending a crafted payload to a connecte...

CVE-2026-109251

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS on a connecting client by supplying invalid geometry coordinates when video redirection is enabled. Because FreeRDP does not properly validate server-provided video coordinates, an intege...

CVE-2026-109250

A flaw was found in FreeRDP. This vulnerability allows a local attacker with access to a physical smartcard or token to trigger a heap-based buffer overflow during smartcard key enumeration. By presenting more public key objects across multiple slots than the internal storage buffer can hold, an...

CVE-2026-109249

A flaw was found in FreeRDP. An out-of-bounds read vulnerability in the Remote Assistance file parser allows an attacker to cause a Denial of Service DoS. By convincing a user to open a specially crafted Remote Assistance invitation file, the application mishandles memory bounds while processing...

CVE-2026-109246

A flaw was found in FreeRDP. An authenticated client can trigger a Denial of Service DoS by sending a specially crafted frame acknowledgment message to the shadow server. Due to missing input validation on the frame identifier, an arithmetic error causes a divide-by-zero condition. This terminate...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

CVE-2026-109244

A flaw was found in FreeRDP. The winpr-makecert utility creates unencrypted private key and certificate archive files without restricting permissions to the file owner, and it assigns a hardcoded default password to exported archives. A local user on a multi-user system can exploit this flaw to...

CVE-2026-109243

A flaw was found in FreeRDP. When software-based smartcard authentication is used on multi-user systems, FreeRDP writes a temporary copy of the private key to a shared directory without enforcing owner-only file permissions. A local, unprivileged attacker can access this shared directory and read...

CVE-2026-109242

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can...

CVE-2026-109257

A flaw was found in FreeRDP. A remote attacker using a specially crafted Remote Desktop Protocol RDP client can request NSCodec compression with large display dimensions to trigger a memory allocation failure on the server. Because the server fails to properly clear memory pointers during error...