The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp | Oct 28, 2026 | Oct 13, 2026 |
| Redhat_linux | — | No solution exists | Oct 19, 2026 | Oct 13, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Oct 18, 2026 | Oct 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub