REDHAT-BUG-2510001: Null Pointer Dereference

Q: Which deployments are exposed to this issue?

FreeRDP deployments before 3.29.0 are exposed when smartcard emulation is enabled. The affected request paths are SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA smartcard cache operations.

Q: What does an attacker need to do to trigger the crash?

An attacker needs to send a crafted smartcard cache request containing a NULL LookupName NDR pointer. The vulnerable decoder passes that pointer to strlen(), causing a null pointer dereference and termination of the client process.

Q: What is the impact of successful exploitation?

Successful exploitation causes the FreeRDP client process to terminate. The provided information describes a denial-of-service condition.

Published Aug 1, 2026

Updated

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

Affected Software

1 affected component

FreeRDP freerdp<3.29.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.29.0
Configuration
Disable smartcard emulation so attackers cannot send crafted smartcard cache requests that trigger the NULL pointer dereference in smartcard cache request decoders for SCARD_IOCTL_READCACHEA/SCARD_IOCTL_WRITECACHEA.
FreeRDP smartcard emulation smartcard emulation = disabled

Event History

Aug 1, 2026

Data Sourced

via Red Hat·01:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP deployments before 3.29.0 are exposed when smartcard emulation is enabled. The affected request paths are SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA smartcard cache operations.

What does an attacker need to do to trigger the crash?

An attacker needs to send a crafted smartcard cache request containing a NULL LookupName NDR pointer. The vulnerable decoder passes that pointer to strlen(), causing a null pointer dereference and termination of the client process.

What is the impact of successful exploitation?

Successful exploitation causes the FreeRDP client process to terminate. The provided information describes a denial-of-service condition.

REDHAT-BUG-2510001: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?