REDHAT-BUG-2510034: Null Pointer Dereference

Q: How can I determine whether my deployment is affected?

FreeRDP versions before 3.29.0 are affected. Deployments running 3.29.0 or later are outside the affected version range stated here.

Q: What must an attacker send to trigger the issue?

The attacker must send malformed smartcard IRP requests with a non-zero cReaders value and truncated reader-state data, causing reader-state decoding to fail during cleanup.

Q: What is the practical impact of successful exploitation?

Successful exploitation can crash the FreeRDP process through a null pointer access in free_reader_states.

Published Aug 1, 2026

Updated

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in freereaderstates functions.

Affected Software

1 affected component

FreeRDP freerdp<3.29.0

Event History

Aug 1, 2026

Data Sourced

via Red Hat·01:04 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

How can I determine whether my deployment is affected?

FreeRDP versions before 3.29.0 are affected. Deployments running 3.29.0 or later are outside the affected version range stated here.

What must an attacker send to trigger the issue?

The attacker must send malformed smartcard IRP requests with a non-zero cReaders value and truncated reader-state data, causing reader-state decoding to fail during cleanup.

What is the practical impact of successful exploitation?

Successful exploitation can crash the FreeRDP process through a null pointer access in free_reader_states.

REDHAT-BUG-2510034: Null Pointer Dereference

Affected Software

Event History

Frequently Asked Questions

How can I determine whether my deployment is affected?

What must an attacker send to trigger the issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

How can I determine whether my deployment is affected?

What must an attacker send to trigger the issue?

What is the practical impact of successful exploitation?