CVE-2026-109250

6.6Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.6Medium

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-129

Impact

Attackers can corrupt heap memory and potentially execute arbitrary code or crash the FreeRDP client. To exploit this, an attacker must have physical access to insert a malicious smartcard token presented to the user during smartcard logon.

Root cause

The collect_keys() function writes past a fixed 64-entry array when enumerating PKCS#11 keys if a smartcard token exposes more than 64 public key objects.

Affected systems

FreeRDP 3.0.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to FreeRDP 3.32.0 or later. If patching immediately is not possible, disable or avoid smartcard redirection and authentication using untrusted physical tokens.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109250