CVE-2026-109250
Received Received - Intake

Heap Buffer Overflow in FreeRDP During PKCS#11 Key Enumeration

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109250
EUVD
EUVD-2026-97694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109250 is a heap buffer overflow in FreeRDP's PKCS#11 key enumeration function collect_keys(). It occurs because a fixed 64-entry array is used without bounds checking, allowing writes beyond the buffer when more than 64 keys are presented by a smartcard token. Attackers controlling the token can corrupt heap memory with chosen data during smartcard logon.

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is between 3.0.0 and 3.31.0, the system is vulnerable.

Impact Analysis

This vulnerability allows local attackers with physical access to a system to corrupt memory by inserting a malicious smartcard. This could lead to crashes, data corruption, or potential code execution if combined with other exploits. It specifically targets smartcard logon or certificate listing processes.

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. Disable smartcard logon or certificate listing if not required. Ensure PKCS#11 modules are from trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart