CVE-2026-109677

EUVD-2026-98699
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.97%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
freerdpfreerdp
𝑥
< 3.28.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
vulnerable
freerdp3
forky
3.32.1+dfsg-1
fixed
sid
3.32.2+dfsg-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/FreeRDP/FreeRDP/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m97-wwx3-r8vj
https://www.vulncheck.com/advisories/freerdp-2.0.0-beta1-before-3.28.0-out-of-bounds-read-via-locatecardsbyatra-handler