Every CVE Search/ Get API key

CVE-2026-109677

FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

7.1 HighFix available

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.35%Unchanged since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
CVE-2026-109677
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-98699 7.1

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
EUVD-2026-98699
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fwx5-6r67-r722 7.1

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in...

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
GHSA-fwx5-6r67-r722
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
NVD 7.1

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
CVE-2026-109677
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-03
OSV 7.1

FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
CVE-2026-109677
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-04
OSVDEBIAN-CVE-2026-109677 7.1

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
DEBIAN-CVE-2026-109677
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
OSVUBUNTU-CVE-2026-109677 7.1

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Record
UBUNTU-CVE-2026-109677
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1792805697 No score

freerdp: Fix of 5 CVEs

  • CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
  • CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
  • CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
  • CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
  • CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
  • CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size
Record
CLSA-2026-1792805697
Updated
2026-11-02
OSVCLSA-2026-1792808931 No score

freerdp: Fix of 2 CVEs

  • CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
  • CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
  • CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
  • CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
  • CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
  • CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size
Record
CLSA-2026-1792808931
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-devel
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-libs
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr-devel
TuxCare:OracleLinux:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-devel
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
freerdp-libs
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
libwinpr-devel
TuxCare:RHEL:7
From an advisory covering 6 CVEs
 before 2.1.1-5.0.9.el7_9.tuxcare.els8
2.1.1-5.0.9.el7_9.tuxcare.els8
Show 11 moreShow less
Affected packages
PackageAffectedFixed
freerdp2
Debian:12
 All versions, plus listed versions
2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2
Show 8 moreShow less
2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1
 None known
freerdp3
Debian:13
 All versions, plus listed versions
3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1
Show 45 moreShow less
3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-13.32.1+dfsg-13.32.1+dfsg-1~bpo13+13.32.2+dfsg-1
 None known
freerdp3
Debian:14
 before 3.28.0+dfsg-1, plus listed versions
3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1
Show 30 moreShow less
3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-1
3.28.0+dfsg-1
freerdp
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
 None known
freerdp2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6
Show 14 moreShow less
2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6
 None known
freerdp
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
 None known
freerdp2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1
Show 12 moreShow less
2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4
 None known
freerdp2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1
Show 18 moreShow less
2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11
 None known
freerdp3
Ubuntu:24.04:LTS
 before 3.30.0+dfsg-0ubuntu0.24.04.1, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1
Show 5 moreShow less
3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.6
3.30.0+dfsg-0ubuntu0.24.04.1
freerdp2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1
Show 7 moreShow less
2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6
 None known
freerdp3
Ubuntu:26.04:LTS
 before 3.30.0+dfsg-0ubuntu0.26.04.1, plus listed versions
3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1
Show 6 moreShow less
3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.1
3.30.0+dfsg-0ubuntu0.26.04.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
affectedOSV
referencesNVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-109677 is a high vulnerability (CVSS 7.1) in Freerdp, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in freerdp3 3.28.0+dfsg-1.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 1 version. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open