634 matches found
CVE-2026-109676
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol RDP server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to...
PKCS11SSHAgent
SRO PKCS11 – SSH Agent CNG Sovereign unification PKCS11 + SSH-agent + Pageant + CNG/Smartcard A single Windows executable that unifies four traditionally separate functions: Full PKCS11 module Firefox, OpenSC, ssh -I SSH agent compatible with OpenSSH/Git/VS/WSL Pageant server compatible with...
CVE-2026-109945
A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by crashing the connecting client application. When a user connects to a server with smartcard emulation enabled, the server can issue concurrent disconnect and transmit...
omapi-cve-2015-6606-exploit
Simple Exploit for Verification of CVE-2015-6606 This is a simple exploit to verify a code injection vulnerability that exists in the SEEK smartcard service versions 3.1.0 and below CVE-2015-6606, Google internal bug ANDROID-22301786. The vulnerability allows specially crafted Android application...
CVE-2026-109949
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can uncover a user's smartcard Personal Identification Number PIN through unrestricted brute-force authentication attempts. Because the virtual smartcard component resets the retry counter on each new connection handle...
CVE-2026-109944
A flaw was found in FreeRDP. When smartcard emulation and redirection are enabled, a malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by crashing the connecting client. This issue occurs because FreeRDP fails to remove card handles when releasing a smartcard emulatio...
CVE-2026-109678
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a specially crafted smartcard status request to a connecting client. When smartcard emulation is active and the client is built with verbose assertions enabled, processing this...
SUSE CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
A flaw was found in FreeRDP. The smartcard emulation backend accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client process. This issue affects FreeRDP 3.0.0...
DEBIAN-CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
EUVD-2026-106997
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a null-pointer dereference within the smartcard emulation backend. The issue occurs when the backend accepts a null per-reader name during SCardGetStatusChange requests. A malicious RDP server can trigger this by sending a crafted reader-stat...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
Linux Distros Unpatched Vulnerability : CVE-2026-109243
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by cryptowritepe...
Linux Distros Unpatched Vulnerability : CVE-2026-109944
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later...
Linux Distros Unpatched Vulnerability : CVE-2026-109678
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA...