CVE-2026-22855: FreeRDP heap out-of-bounds read in smartcard SetAttrib

CVE-2026-22855 · Severity: critical · CVSS 9.1 · Published 2026-01-14

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source tool used to connect to remote computers via the Remote Desktop Protocol (RDP). A security flaw in how it handles smartcard redirection allows a malicious server to read sensitive information from the memory of the connecting user's computer. This could lead to the exposure of private data or cause the remote desktop application to crash.

Technical details

A heap out-of-bounds read vulnerability exists in FreeRDP's smartcard redirection component, specifically within the 'smartcard_unpack_set_attrib_call' function. The root cause is a discrepancy between the 'cbAttrLen' value read from the network stream and the actual length of the NDR (Network Data Representation) buffer allocated via 'smartcard_ndr_read'. An attacker controlling a malicious RDP server or performing a Man-in-the-Middle (MITM) attack can send a crafted SetAttrib request with a large 'cbAttrLen' but a smaller NDR length. When the client subsequently calls 'SCardSetAttrib' or 'smartcard_trace_set_attrib_call' using the oversized length, it reads beyond the allocated heap buffer. This can result in information disclosure or a denial-of-service (crash). The issue is resolved in version 3.20.1.

CVE-2026-22855: FreeRDP heap out-of-bounds read in smartcard SetAttrib

Executive brief

Technical details

Affected products

Timeline

References

Related threats