CVE-2026-109250

Published: Oct 12, 2026Modified: Oct 15, 2026

7.0

Vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.

Related CWEs

CWE-129

Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (3)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhv5-m83m-hxhq

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-buffer-overflow-via-pkcs-11-collect-keys

Source: disclosure@vulncheck.com

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jhv5-m83m-hxhq

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.