CVE-2026-109677 FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
Malicious RDP servers can trigger an out-of-bounds read in FreeRDP to leak heap memory, aiding ASLR bypass and remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109677?
CVE-2026-109677 is a high-severity vulnerability in FreeRDP, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.
Weakness: CWE-125
Which versions are affected by CVE-2026-109677?
How do I fix CVE-2026-109677?
Upgrade to a fixed version.
Is CVE-2026-109677 being exploited?
There is no known exploitation of CVE-2026-109677 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109677, GHSA-8m97-wwx3-r8vj, GHSA-fwx5-6r67-r722, UBUNTU-CVE-2026-109677.