CVE-2026-67288
Received Received - Intake

Null Pointer Dereference in FreeRDP Smartcard Cache Request

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67288
EUVD
EUVD-2026-51819

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a null pointer dereference flaw in smartcard cache request decoders. Attackers can exploit this by sending crafted smartcard cache requests with NULL lookup-name pointers to operations like SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA. This causes the client process to crash by triggering strlen() on a null pointer when smartcard emulation is enabled.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for smartcard cache request anomalies. Use 'xfreerdp --version' or 'freerdp2 --version' to verify if your FreeRDP version is below 3.29.0. Inspect network traffic for SCARD_IOCTL_READCACHEA or SCARD_IOCTL_WRITECACHEA requests with NULL lookup-name pointers.

Impact Analysis

This vulnerability allows attackers to remotely terminate FreeRDP client processes by sending specially crafted smartcard cache requests. If smartcard emulation is enabled, it could lead to denial-of-service conditions, disrupting remote desktop sessions or applications relying on FreeRDP.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later immediately. Disable smartcard emulation if not required. Monitor for suspicious smartcard cache requests and terminate affected client processes. Apply network-level filtering to block malformed smartcard cache requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67288. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart