CVE-2026-109677: FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
FreeRDP users are exposed when they connect to a malicious RDP server. Exploitation requires user interaction, as reflected by the UI:R vector, but does not require attacker privileges.
What can an attacker gain from this flaw?
A malicious server can use query timing as an oracle to leak heap memory bit by bit. This can defeat ASLR and help make further remote-code-execution exploits practical; the stated direct impact is confidentiality loss.
What version remediates the issue?
Upgrade to FreeRDP 3.28.0 or later. The affected range begins with 2.0.0-beta1 and includes versions before 3.28.0.