← Database

CVE-2026-91945

MEDIUM CVSS: 6.5 Published: 2026-09-15 Modified: 2026-09-16

Description

FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.

Affected Platforms

Unknown

Weakness Type

CWE-125

References