FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-devel | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | Upgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdp-devel | Aug 12, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-devel | Sep 2, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub