CVEvulnerability
CVE-2026-109677
7.1 HIGH
Official page ↗
- Status
- Undergoing Analysis
- Published
- 2026-10-13
- Last modified
- 2026-10-13
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 7.1 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-125
Description
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://github.com/FreeRDP/FreeRDP/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1 github.com
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m97-wwx3-r8vj github.com
- https://www.vulncheck.com/advisories/freerdp-2.0.0-beta1-before-3.28.0-out-of-bounds-read-via-locatecardsbyatra-handler www.vulncheck.com