Out-of-Bounds Read Vulnerability in FreeRDP by FreeRDP

CVE-2026-109677

What is CVE-2026-109677?

FreeRDP versions prior to 3.28.0 are susceptible to an out-of-bounds read vulnerability within the smartcard_LocateCardsByATRA_Call function. This flaw arises as the ATR pattern's byte count (cbAtr) is not properly limited. It enables malicious RDP servers to transmit specially crafted ATR mask arrays, which can exploit query timing to leak portions of heap memory, potentially undermining ASLR security measures and facilitating remote code execution (RCE) exploits.

References