CVE-2026-67304: FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
Published Aug 1, 2026
·Updated
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in freereaderstates functions.
Affected Software
1 affected component
FreeRDP freerdp<3.29.0
Event History
Aug 1, 2026
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·01:04 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-67304?
The severity of CVE-2026-67304 is high, rated at 8.7.
2
How do I fix CVE-2026-67304?
To fix CVE-2026-67304, update to FreeRDP version 3.29.0 or later.
3
What is the risk associated with CVE-2026-67304?
CVE-2026-67304 has a risk score of 47, indicating a significant vulnerability.
4
What type of vulnerability is CVE-2026-67304?
CVE-2026-67304 is a null pointer dereference vulnerability.
5
What can exploit CVE-2026-67304?
Attackers can exploit CVE-2026-67304 by sending malformed smartcard IRP requests to crash the FreeRDP process.