CVE-2026-109940: FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKAID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKAID can overflow the client's stack during key enumeration, causing a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Unix builds of FreeRDP with PKCS#11 support are affected if they are version 3.0.0-beta1 through versions before 3.32.0. The issue is in WinPR's NCrypt PKCS#11 provider.
What must an attacker control to trigger the crash?
The attacker must supply a malicious PKCS#11 token or module containing a key and matching certificate with a CKA_ID between 55 and 64 bytes. The overflow occurs while the client enumerates keys.
What is the expected impact of successful exploitation?
The described outcome is a client-side stack overflow that causes a crash. The provided information does not claim confidentiality or integrity impact.
What can be done before upgrading?
Avoid enumerating keys from untrusted PKCS#11 tokens or modules, particularly where their key and certificate CKA_ID values are attacker-controlled. The provided data does not identify another mitigation.