CVE-2026-109677
FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
| CWE | CWE-125 |
| Vendor | freerdp |
| Product | freerdp |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for freerdp freerdp
Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
FreeRDP / FreeRDP
2.0.0-beta1 < 3.28.0
References
github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m97-wwx3-r8vj github.com: https://github.com/FreeRDP/FreeRDP/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1 vulncheck.com: https://www.vulncheck.com/advisories/freerdp-2.0.0-beta1-before-3.28.0-out-of-bounds-read-via-locatecardsbyatra-handler
Credits
🔍 alexdowad