CVE-2026-109250: FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

Q: Who is exposed to this issue?

FreeRDP installations running versions 3.0.0 before 3.32.0 are exposed when they use PKCS#11 smartcard logon and enumerate keys from a token controlled by an attacker.

Q: What does an attacker need to exploit it?

The attacker needs control of a smartcard token presented during smartcard logon. The token must expose more than 64 public-key objects across multiple slots, with attacker-controlled CKA_ID and CKA_LABEL data.

Q: Are systems using FreeRDP without PKCS#11 smartcard logon affected through this path?

The described overflow occurs during PKCS#11 key enumeration for smartcard logon. The provided information does not identify another affected path.

Q: What can be done if upgrading is not immediately possible?

Avoid using attacker-controlled smartcard tokens for PKCS#11 smartcard logon, particularly tokens that may expose large numbers of public-key objects. Upgrade to FreeRDP 3.32.0 or later when possible.

Published Oct 12, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKAID and CKALABEL data during smartcard logon.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP installations running versions 3.0.0 before 3.32.0 are exposed when they use PKCS#11 smartcard logon and enumerate keys from a token controlled by an attacker.

What does an attacker need to exploit it?

The attacker needs control of a smartcard token presented during smartcard logon. The token must expose more than 64 public-key objects across multiple slots, with attacker-controlled CKA_ID and CKA_LABEL data.

Are systems using FreeRDP without PKCS#11 smartcard logon affected through this path?

The described overflow occurs during PKCS#11 key enumeration for smartcard logon. The provided information does not identify another affected path.

What can be done if upgrading is not immediately possible?

Avoid using attacker-controlled smartcard tokens for PKCS#11 smartcard logon, particularly tokens that may expose large numbers of public-key objects. Upgrade to FreeRDP 3.32.0 or later when possible.

CVE-2026-109250: FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are systems using FreeRDP without PKCS#11 smartcard logon affected through this path?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are systems using FreeRDP without PKCS#11 smartcard logon affected through this path?

What can be done if upgrading is not immediately possible?