What’s Vulnerable › Vulnerabilities

CVE-2026-109677: FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-13
• Weakness: CWE-125

Description

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Affected products

• FreeRDP: from 2.0.0-beta1 before 3.28.0 — fixed in 3.28.0

How to fix

Upgrade to a fixed version: FreeRDP 3.28.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreeRDP/FreeRDP/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m97-wwx3-r8vj
• https://www.vulncheck.com/advisories/freerdp-2.0.0-beta1-before-3.28.0-out-of-bounds-read-via-locatecardsbyatra-handler

Get alerted when CVE-2026-109677 or the next vulnerability affects your stack