Executive brief
FreeRDP is a popular open-source Remote Desktop Protocol implementation used for remote desktop access and terminal server functionality. An authenticated RDP client can send specially crafted smartcard device responses with oversized ATR (Answer-to-Reset) lengths that cause the server to read beyond allocated memory buffers, crashing the FreeRDP process and causing a denial of service.
Technical details
The vulnerability is a classic out-of-bounds read (CWE-125) in smartcard response decoding functions smartcard_unpack_status_return() and smartcard_unpack_get_status_change_return() in libfreerdp/utils/smartcard_pack.c. These decoders accept ATR length fields from client RDPDR PAKID_CORE_DEVICE_IOCOMPLETION responses without validating that the lengths match fixed inline array sizes (32 bytes for Status_Return.pbAtr and 36 bytes for ReaderState_Return.rgbAtr). An authenticated RDP client with an outstanding Status or GetStatusChange request can send an oversized ATR length, which is then read by debug-level logging (smartcard_create_array_dump) or by embedding server callbacks that trust the unchecked length. The affected versions are FreeRDP 3.28.0 through 3.30.0. The fix adds bounds checking similar to existing validation in smartcard_ndr_read_atrmask(), rejecting cbAtr values exceeding array capacity. The vulnerability requires authentication and an active smartcard redirection device with a pending request.
Affected products
- FreeRDP FreeRDP 3.28.0 through 3.30.0
Timeline
- 2026-08-31: disclosed: GitHub security advisory GHSA-q65v-4w7q-hx3r published
- 2026-09-15: advisory: CVE-2026-91945 published
- 2026-09-15: patched: Fix available in FreeRDP 3.31.0