FreeRDP up to 3.28.x free_reader_states null pointer dereference

Summaryinfo

A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.28.x. Affected is the function free_reader_states. Such manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2026-67304. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.28.x. Affected by this issue is the function free_reader_states. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. CVE summarizes:

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-67304 since 07/29/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 331646 (Linux Distros Unpatched Vulnerability : CVE-2026-67304), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.29.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (331646) and EUVD (EUVD-2026-51848). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion