CVE-2026-109250: FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKAID and CKALABEL data during smartcard logon.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP installations running versions 3.0.0 before 3.32.0 are exposed when they use PKCS#11 smartcard logon and enumerate keys from a token controlled by an attacker.
What does an attacker need to exploit it?
The attacker needs control of a smartcard token presented during smartcard logon. The token must expose more than 64 public-key objects across multiple slots, with attacker-controlled CKA_ID and CKA_LABEL data.
Are systems using FreeRDP without PKCS#11 smartcard logon affected through this path?
The described overflow occurs during PKCS#11 key enumeration for smartcard logon. The provided information does not identify another affected path.
What can be done if upgrading is not immediately possible?
Avoid using attacker-controlled smartcard tokens for PKCS#11 smartcard logon, particularly tokens that may expose large numbers of public-key objects. Upgrade to FreeRDP 3.32.0 or later when possible.