CVE-2026-91945

FreeRDP versions before 3.31.0 contain an out-of-bounds read (CWE-125) in the smartcard response decoders, which fail to validate attacker-supplied ATR length fields against the size of fixed inline arrays. An authenticated malicious RDP client can exploit this by sending an oversized ATR length inside a PAKID_CORE_DEVICE_IOCOMPLETION response during smartcard device redirection, causing reads past stack or heap objects and terminating the process. The impact is limited to availability (CVSS 4.0: 7.1, VA:H with no confidentiality or integrity impact), so this is a denial-of-service flaw rather than a data-exposure or code-execution bug. FreeRDP-based RDP servers, proxies, and any third-party products embedding FreeRDP's server-side smartcard redirection code before 3.31.0 are affected, and exploitation requires valid RDP credentials or an authenticated session with smartcard redirection enabled. No public proof of concept exists and the flaw is not on the CISA KEV list, so exploitation in the wild is not currently known.

What to do: Upgrade FreeRDP to version 3.31.0 or later, and check whether any vendor products that embed FreeRDP (RDP proxies, remote-access gateways, thin-client servers) have shipped a fixed build. If patching is not immediately possible, disable smartcard (SCARD) device redirection for RDP sessions and restrict which authenticated users can reach the affected servers. Monitor FreeRDP-based processes for unexpected crashes in smartcard handling, which would be the primary indicator of an exploitation attempt.