CVE-2026-109677

Versions of FreeRDP from 2.0.0-beta1 before 3.28.0 are vulnerable to an out-of-bounds read in the smartcard_LocateCardsByATRA_Call function. The root cause is that the cbAtr byte count is not capped, allowing malicious RDP servers to send crafted ATR mask arrays. Attackers can use query timing as...