FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-libs-debuginfo | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | Upgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr | Sep 2, 2026 | Aug 1, 2026 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-server-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfo | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub