CVE-2026-109948: FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcardpacktransmitreturn to serialize up to 66,560 uninitialized heap bytes.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when smartcard redirection is used with a malicious RDP server.
What does an attacker need to exploit this issue?
An attacker needs to operate or control an RDP server that a user connects to. The server can send an SCardTransmit request using an invalid card handle and a nonzero receive length; no attacker privileges are required, but user interaction is required.
What information can be exposed?
The malicious server can cause serialization of uninitialized client heap memory. The disclosed data can be up to 66,560 bytes.