CVE-2026-109940
Received Received - Intake

Stack-Based Buffer Overflow in FreeRDP PKCS#11 Provider

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109940
EUVD
EUVD-2026-98705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0-beta1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109940 is a stack-based buffer overflow in FreeRDP 3.0.0-beta1 through 3.31.1 on Unix builds with PKCS#11 support. It occurs in the wprintKeyName() function when a key's CKA_ID (55-64 bytes) is hex-encoded into a fixed 128-byte stack buffer. This overflows the buffer during key enumeration, causing crashes but no reliable code execution.

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is between 3.0.0 and 3.31.1 on Unix systems with PKCS#11 support enabled. Run 'freerdp --version' to check the version. If PKCS#11 is enabled, test with a malicious token by enumerating keys and observing crashes during key enumeration.

Impact Analysis

An attacker with local physical or token-provider access could crash the FreeRDP client or corrupt its stack by supplying a malicious PKCS#11 token with a 55-64 byte CKA_ID. This requires no active RDP session, signing, or PIN entry. The impact is limited to denial of service (crash) rather than code execution or privilege escalation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical flaw in FreeRDP's PKCS#11 support. However, if exploited, it could lead to system crashes or potential data corruption, which may indirectly impact compliance by disrupting secure data handling processes. No evidence suggests it enables unauthorized data access or disclosure.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later if available. If upgrading is not possible, disable PKCS#11 support in FreeRDP by removing or disabling the PKCS#11 module. Avoid using untrusted PKCS#11 tokens or modules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart