CVE-2026-109677
6.5MediumPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality
- Weakness
- CWE-125
Impact
A malicious RDP server can leak heap memory bit-by-bit to defeat ASLR when a client connects to it. To exploit this, the attacker needs a user to initiate an RDP session to an untrusted server.
Root cause
The smartcard_LocateCardsByATRA_Call handler fails to cap the cbAtr byte count in the ATR pattern, triggering an out-of-bounds read.
Affected systems
FreeRDP 2.0.0-beta1 before 3.28.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade FreeRDP to version 3.28.0 or newer. As an interim mitigation, do not connect to untrusted RDP servers or disable smartcard redirection.
$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp2-x11AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.