CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection
Malicious RDP servers can read client memory via uninitialized heap bytes in FreeRDP smartcard redirection, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109948?
CVE-2026-109948 is a medium-severity vulnerability in Freerdp Freerdp, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcard_pack_transmit_return to serialize up to 66,560 uninitialized heap bytes.
Weakness: CWE-200
Which versions are affected by CVE-2026-109948?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-109948?
Upgrade to a fixed version.
Is CVE-2026-109948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109948 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-109948, GHSA-f554-v4xw-5j39, GHSA-xh9q-86wg-w2r5, UBUNTU-CVE-2026-109948.