CVE-2026-67288: FreeRDP before 3.29.0 Denial of Service via smartcard cache
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67288?
CVE-2026-67288 has a high severity rating of 7.5.
How do I fix CVE-2026-67288?
To remediate CVE-2026-67288, upgrade FreeRDP to version 3.29.0 or later.
What type of vulnerability is CVE-2026-67288?
CVE-2026-67288 is identified as a null pointer dereference vulnerability.
What can attackers exploit in CVE-2026-67288?
Attackers can exploit CVE-2026-67288 by sending crafted smartcard cache requests when smartcard emulation is enabled.
What operations are affected by CVE-2026-67288?
CVE-2026-67288 affects the SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.