CVE-2026-91945: FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKIDCOREDEVICEIOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
freerdp/smartcardto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated RDP client can exploit it by sending a crafted PAKID_CORE_DEVICE_IOCOMPLETION response containing an oversized smartcard ATR length. The provided data does not indicate that unauthenticated attackers can trigger it.
What is the likely impact of successful exploitation?
The out-of-bounds read can cause the affected FreeRDP process to terminate, resulting in a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
Which deployments are affected?
FreeRDP versions before 3.31.0 are affected where the vulnerable smartcard response decoding path can process the crafted response. The data does not state whether smartcard functionality is enabled by default or provide a configuration-only mitigation.
How can I determine whether an installation is affected?
Check the installed FreeRDP version. Versions earlier than 3.31.0 should be treated as affected based on the provided information.