CVE-2026-109677
MEDIUMCVSS 6.5Description
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
Timeline
Published:October 13th, 2026 2:17 PM
Last modified:November 2nd, 2026 8:52 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Software
From NVD CPE configuration data
Vendors
freerdp
Products
freerdp
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute