CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name

What is CVE-2026-109940?

CVE-2026-109940 is a medium-severity memory corruption vulnerability in Freerdp Freerdp, published on 13 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash.

Weakness: CWE-121

Which versions are affected by CVE-2026-109940?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-109940?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-109940 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109940 exists.

Other vulnerabilities in Freerdp Freerdp

• CVE-2021-37594 Other in n/a Critical 9.8
• CVE-2021-37595 Other in n/a Critical 9.8
• CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr Critical 9.4
• CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass Critical 9.3
• CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection Critical 9.3

All Freerdp Freerdp vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-109940, GHSA-9579-j8rw-69mx, GHSA-g8jw-gv54-r94p, UBUNTU-CVE-2026-109940.