CVE-2026-109677

Versions of FreeRDP from 2.0.0-beta1 before 3.28.0 are vulnerable to an out-of-bounds read in the smartcard_LocateCardsByATRA_Call function. The root cause is that the cbAtr byte count is not capped, allowing malicious RDP servers to send crafted ATR mask arrays. Attackers can use query timing as...

PT-2026-120382

Уязвимость функции smartcard LocateCardsByATRA Call RDP-клиента FreeRDP связана с чтением за пределами допустимого диапазона в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти механизм защиты ASLR...

PT-2026-111529

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0-beta1 through 3.27.0 Description An out-of-bounds read exists in the smartcard LocateCardsByATRA Call function due to the cbAtr byte count in the ATR pattern not being capped. A malicious RDP server can send crafted ATR...