Stack-Based Buffer Overflow in FreeRDP on Unix Builds with PKCS#11 Support

CVE-2026-109940

What is CVE-2026-109940?

A vulnerability exists in FreeRDP versions before 3.32.0 running on Unix systems with PKCS#11 support, where the function wprintKeyName() is susceptible to a stack-based buffer overflow. This occurs due to the improper handling of a hex-encoded key's CKA_ID, which can be as long as 64 bytes, being written into a fixed 128-byte stack buffer. An attacker could exploit this flaw by providing a malicious PKCS#11 token or module, potentially leading to a crash during key enumeration.

References