Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-91945

FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 3.28.0 to < 3.31.0affected
  • 3.31.0unaffected

References