CVE-2026-109250 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical security flaw within the cryptographic module responsible for handling PKCS#11 key enumeration. Specifically, the defect resides in the collect_keys function, which is tasked with retrieving and processing public key objects from smartcard tokens connected via PC/SC interfaces. The core technical issue stems from an insufficient boundary check when iterating through available slots on a hardware security token. FreeRDP maintains a fixed-size array designed to hold up to sixty-four entries for these keys. However, the implementation fails to validate whether the total number of public key objects presented by the smartcard exceeds this hardcoded limit before attempting to write them into memory. This lack of input validation allows an attacker who controls the physical or logical access to the smartcard token to trigger a heap buffer overflow condition.
From an operational perspective, this vulnerability is classified as local in nature because it requires the user to interact with a specific hardware peripheral during the authentication process. An adversary possessing control over a compromised or maliciously crafted smartcard can exploit this flaw by presenting more than sixty-four public key objects distributed across multiple slots on the token. During the PKCS#11 enumeration phase, which occurs when FreeRDP attempts to log in using credentials stored on the device, the application will attempt to store each retrieved key into its internal data structure without verifying if the array bounds have been exceeded. Consequently, subsequent writes past the end of the sixty-four-entry buffer result in heap memory corruption. The attacker can manipulate this overflow by carefully crafting the CKA_ID and CKA_LABEL attributes associated with the excess keys, thereby injecting arbitrary data into adjacent memory regions on the heap.
The impact of such a heap-based buffer overflow is severe, as it provides a pathway for arbitrary code execution or denial of service against the FreeRDP client application running on the host system. By overwriting critical metadata structures within the heap allocator, an attacker can potentially alter control flow pointers, leading to remote code execution if combined with other exploitation techniques such as heap spraying or specific allocation grooming strategies. Even without achieving full code execution, memory corruption can lead to application crashes and data integrity issues, disrupting secure remote desktop sessions. This vulnerability aligns closely with CWE-120, which describes buffer copies without checking size limits, a fundamental category of input validation errors that frequently leads to exploitable conditions in C-based applications like FreeRDP.
Furthermore, the exploitation vector relates to ATT&CK technique T1557, specifically Adversary-in-the-Middle or credential harvesting via physical access scenarios where an attacker substitutes legitimate hardware tokens with malicious ones during authentication flows. The ability to corrupt memory through smartcard logon highlights a broader risk in environments relying heavily on PKCS#11 for multi-factor authentication. To mitigate this vulnerability, organizations must ensure that all FreeRDP installations are updated to version 3.32.0 or later, where the collect_keys function has been patched with proper bounds checking logic. Additionally, security teams should enforce strict policies regarding which smartcard tokens can be used within their remote desktop infrastructure and consider implementing hardware-based restrictions at the endpoint level to prevent unauthorized peripheral devices from being enumerated during authentication sequences. Regular auditing of third-party dependencies and maintaining an up-to-date software inventory are essential practices to minimize exposure to such memory safety vulnerabilities in critical communication tools.