CVE-2026-109677

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109677
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109677.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109677
Aliases
  • GHSA-8m97-wwx3-r8vj
Downstream
CLSA (2)
DEBIAN (1)
UBUNTU (1)
Published
2026-10-13T13:27:06Z
Modified
2026-11-04T07:04:24Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
Details

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109677.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
5ab2bed8749747b8e4b2ed431fd102bc726be684
Fixed
5370fb26fbf034ecd11d3026b6ad639b5fff493f
Fixed
ececc5cbd0646ef012ca178322e6ef922a11f0c1
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "3.28.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "ececc5cbd0646ef012ca178322e6ef922a11f0c1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.0.0
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109677.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "6407528131741304170432046328053930139",
                "164729257970101820815286864294360991779",
                "55346540778163400526438921263182978621",
                "149710347463825652923018444511089425149",
                "34344493978856758359045551511801539420",
                "214638939173712067427026949266766070666",
                "263973817098840991694643973280766110779",
                "306386957539050910651836519098535953386",
                "34344493978856758359045551511801539420",
                "214638939173712067427026949266766070666",
                "263973817098840991694643973280766110779",
                "306386957539050910651836519098535953386"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109677-4737483f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1",
        "target": {
            "file": "libfreerdp/utils/smartcard_pack.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304576413029495508821635164581837598418",
            "length": 1474
        },
        "id": "CVE-2026-109677-48fdf084",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1",
        "target": {
            "file": "libfreerdp/utils/smartcard_pack.c",
            "function": "smartcard_unpack_reader_state_a"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "296433965035757121926397416981880880340",
            "length": 1474
        },
        "id": "CVE-2026-109677-75e18572",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1",
        "target": {
            "file": "libfreerdp/utils/smartcard_pack.c",
            "function": "smartcard_unpack_reader_state_w"
        }
    }
]
vanir_signatures_modified 
"2026-11-04T07:04:24Z"