CVE-2026-109940
FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash.
| CWE | CWE-121 |
| Vendor | freerdp |
| Product | freerdp |
| Published | Oct 13, 2026 |
| Last Updated | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for freerdp freerdp
Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
FreeRDP / FreeRDP
3.0.0-beta1 < 3.32.0
References
Credits
Kushalkhemka opensec-intelligence mayank-jangid-moon skigeek16