Vulnerability-Lookup

CVE-2026-67288 (GCVE-0-2026-67288)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 19:49

Title

FreeRDP before 3.29.0 Denial of Service via smartcard cache

Summary

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 19:47 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/FreeRDP/FreeRDP/security/advis…	vendor-advisory
https://github.com/FreeRDP/FreeRDP/commit/f3b4347…	patch
https://github.com/FreeRDP/FreeRDP/commit/5370fb2…	patch
https://www.vulncheck.com/advisories/freerdp-befo…	third-party-advisory
https://github.com/FreeRDP/FreeRDP/security/advis…	exploit

Impacted products

1 product

Vendor	Product	Version	CPE status
FreeRDP	FreeRDP	Affected: 0 , < 3.29.0 (semver) Unaffected: 3.29.0 (semver) cpe:2.3:a:freerdp:freerdp::::::::

Date Public

2026-07-15 00:00

Credits

1121984919

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67288",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T19:47:44.966327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T19:49:39.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "1121984919"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T12:22:18.305Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
        }
      ],
      "title": "FreeRDP before 3.29.0 Denial of Service via smartcard cache",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67288",
    "datePublished": "2026-08-01T12:22:18.305Z",
    "dateReserved": "2026-07-29T13:01:57.547Z",
    "dateUpdated": "2026-08-03T19:49:39.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-67288",
      "date": "2026-09-15",
      "epss": "0.00346",
      "percentile": "0.27862"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-67288\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-08-01T13:16:57.650\",\"lastModified\":\"2026-09-03T19:38:52.697\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"FreeRDP\",\"product\":\"FreeRDP\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.29.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.29.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-03T19:47:44.966327Z\",\"id\":\"CVE-2026-67288\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.29.0\",\"matchCriteriaId\":\"BEF953A8-09AB-44BA-8829-5E0E856E973E\"}]}]}],\"references\":[{\"url\":\"https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Not Applicable\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-10T03:34:45+00:00",
      "cve": "CVE-2026-67288",
      "id": "CVE-2026-67288",
      "initial_release_date": "2026-08-01T12:22:18.305000+00:00",
      "product_status:fixed": "299",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67288.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:43:42Z",
      "cve": "CVE-2026-67288",
      "id": "CVE-2026-67288",
      "initial_release_date": "2026-08-03T17:12:27Z",
      "product_status:known_affected": "93",
      "product_status:known_not_affected": "74",
      "product_status:recommended": "16",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-67288",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-67288.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-67288\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-03T19:47:44.966327Z\"}}}], \"references\": [{\"url\": \"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-03T19:48:12.362Z\"}}], \"cna\": {\"title\": \"FreeRDP before 3.29.0 Denial of Service via smartcard cache\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"1121984919\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"FreeRDP\", \"product\": \"FreeRDP\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.29.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"3.29.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-07-15T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3\", \"name\": \"GitHub Security Advisory (GHSA-ph3q-f9w8-7jf3)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f\", \"name\": \"Patch Commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f\", \"name\": \"Patch Commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache\", \"name\": \"VulnCheck Advisory: FreeRDP before 3.29.0 Denial of Service via smartcard cache\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"NULL Pointer Dereference\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.29.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-08-01T12:22:18.305Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-67288\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-03T19:49:39.908Z\", \"dateReserved\": \"2026-07-29T13:01:57.547Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-08-01T12:22:18.305Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

alsa-2026:61378

Vulnerability from osv_almalinux

Published

2026-08-31 00:00

Modified

2026-09-04 06:39

Summary

Important: freerdp security update

Details

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)
FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)
FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)
FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)
FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)
FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)
FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)
freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:61378	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-55194	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63633	REPORT
	https://access.redhat.com/security/cve/CVE-2026-63652	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67288	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67291	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67296	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67297	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67298	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67301	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67304	REPORT
	https://access.redhat.com/security/cve/CVE-2026-69159	REPORT
	https://access.redhat.com/security/cve/CVE-2026-73241	REPORT
	https://access.redhat.com/security/cve/CVE-2026-73242	REPORT
	https://bugzilla.redhat.com/2509986	REPORT
	https://bugzilla.redhat.com/2509994	REPORT
	https://bugzilla.redhat.com/2510001	REPORT
	https://bugzilla.redhat.com/2510010	REPORT
	https://bugzilla.redhat.com/2510029	REPORT
	https://bugzilla.redhat.com/2510034	REPORT
	https://bugzilla.redhat.com/2510041	REPORT
	https://bugzilla.redhat.com/2514346	REPORT
	https://bugzilla.redhat.com/2514349	REPORT
	https://bugzilla.redhat.com/2519822	REPORT
	https://bugzilla.redhat.com/2519824	REPORT
	https://bugzilla.redhat.com/2519826	REPORT
	https://bugzilla.redhat.com/2519828	REPORT
	https://errata.almalinux.org/10/ALSA-2026-61378.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "freerdp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "freerdp-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "freerdp-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "freerdp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libwinpr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "libwinpr-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:3.10.3-12.el10_2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  \n\nSecurity Fix(es):  \n\n  * FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses (CVE-2026-67297)\n  * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n  * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n  * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n  * FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing (CVE-2026-67296)\n  * FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup (CVE-2026-67304)\n  * FreeRDP: FreeRDP: Denial of Service via integer underflow in RAIL channel handling (CVE-2026-67298)\n  * FreeRDP: FreeRDP: Out-of-bounds memory access in Kerberos decryption (CVE-2026-73242)\n  * FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling (CVE-2026-73241)\n  * FreeRDP: FreeRDP: Denial of Service and heap corruption via malformed RDP audio PDU (CVE-2026-63652)\n  * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n  * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode (CVE-2026-63633)\n  * FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure (CVE-2026-69159)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:61378",
  "modified": "2026-09-04T06:39:27Z",
  "published": "2026-08-31T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:61378"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-55194"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63633"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-63652"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67288"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67291"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67296"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67297"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67298"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67301"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67304"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-69159"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73241"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73242"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2509986"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2509994"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510001"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510010"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510029"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510034"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510041"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2514346"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2514349"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519822"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519824"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519826"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519828"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-61378.html"
    }
  ],
  "related": [
    "CVE-2026-67297",
    "CVE-2026-67301",
    "CVE-2026-67288",
    "CVE-2026-67291",
    "CVE-2026-67296",
    "CVE-2026-67304",
    "CVE-2026-67298",
    "CVE-2026-73242",
    "CVE-2026-73241",
    "CVE-2026-63652",
    "CVE-2026-55194",
    "CVE-2026-63633",
    "CVE-2026-69159"
  ],
  "summary": "Important: freerdp security update"
}

alsa-2026:61379

Vulnerability from osv_almalinux

Published

2026-08-31 00:00

Modified

2026-09-02 08:35

Summary

Important: freerdp security update

Details

Security Fix(es):

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:61379	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-55194	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67288	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67291	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67301	REPORT
	https://bugzilla.redhat.com/2509994	REPORT
	https://bugzilla.redhat.com/2510001	REPORT
	https://bugzilla.redhat.com/2510010	REPORT
	https://bugzilla.redhat.com/2519824	REPORT
	https://errata.almalinux.org/9/ALSA-2026-61379.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "freerdp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-7.el9_8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "freerdp-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-7.el9_8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "freerdp-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-7.el9_8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "libwinpr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-7.el9_8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "libwinpr-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-7.el9_8.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  \n\nSecurity Fix(es):  \n\n  * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n  * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n  * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n  * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:61379",
  "modified": "2026-09-02T08:35:22Z",
  "published": "2026-08-31T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:61379"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-55194"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67288"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67291"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67301"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2509994"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510001"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510010"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519824"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-61379.html"
    }
  ],
  "related": [
    "CVE-2026-67301",
    "CVE-2026-67288",
    "CVE-2026-67291",
    "CVE-2026-55194"
  ],
  "summary": "Important: freerdp security update"
}

alsa-2026:62571

Vulnerability from osv_almalinux

Published

2026-09-02 00:00

Modified

2026-09-02 14:04

Summary

Important: freerdp security update

Details

Security Fix(es):

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)
FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)
FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)
FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:62571	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-55194	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67288	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67291	REPORT
	https://access.redhat.com/security/cve/CVE-2026-67301	REPORT
	https://bugzilla.redhat.com/2509994	REPORT
	https://bugzilla.redhat.com/2510001	REPORT
	https://bugzilla.redhat.com/2510010	REPORT
	https://bugzilla.redhat.com/2519824	REPORT
	https://errata.almalinux.org/8/ALSA-2026-62571.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "freerdp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-12.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "freerdp-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-12.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "freerdp-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-12.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libwinpr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-12.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libwinpr-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:2.11.7-12.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.  \n\nSecurity Fix(es):  \n\n  * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301)\n  * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288)\n  * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291)\n  * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:62571",
  "modified": "2026-09-02T14:04:41Z",
  "published": "2026-09-02T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:62571"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-55194"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67288"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67291"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-67301"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2509994"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510001"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2510010"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2519824"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-62571.html"
    }
  ],
  "related": [
    "CVE-2026-67301",
    "CVE-2026-67288",
    "CVE-2026-67291",
    "CVE-2026-55194"
  ],
  "summary": "Important: freerdp security update"
}

FKIE_CVE-2026-67288

Vulnerability from fkie_nvd - Published: 2026-08-01 13:16 - Updated: 2026-09-03 19:38

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
disclosure@vulncheck.com	https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f	Patch
disclosure@vulncheck.com	https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f	Patch
disclosure@vulncheck.com	https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3	Patch, Vendor Advisory
disclosure@vulncheck.com	https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache	Patch, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f	Not Applicable

Impacted products

	Vendor	Product	Version
	freerdp	freerdp	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.29.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.29.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF953A8-09AB-44BA-8829-5E0E856E973E",
              "versionEndExcluding": "3.29.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination."
    }
  ],
  "id": "CVE-2026-67288",
  "lastModified": "2026-09-03T19:38:52.697",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-67288",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-03T19:47:44.966327Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-01T13:16:57.650",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HQ8H-RVCV-JVH4

Vulnerability from github – Published: 2026-08-01 15:30 – Updated: 2026-08-03 21:31

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-67288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-01T13:16:57Z",
    "severity": "HIGH"
  },
  "details": "FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination.",
  "id": "GHSA-hq8h-rvcv-jvh4",
  "modified": "2026-08-03T21:31:30Z",
  "published": "2026-08-01T15:30:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5wr6-8m8j-3h7f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67288"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

RHSA-2026:61378

Vulnerability from csaf_redhat - Published: 2026-08-31 13:01 - Updated: 2026-09-10 03:34

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Scope

13 vulnerabilities in this advisory, including CVE-2026-67288.

CVE-2026-67288

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:61378

Open the full advisory

RHSA-2026:61379

Vulnerability from csaf_redhat - Published: 2026-08-31 12:55 - Updated: 2026-09-10 03:34

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-67288.

CVE-2026-67288

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:61379

Open the full advisory

RHSA-2026:62571

Vulnerability from csaf_redhat - Published: 2026-09-02 11:40 - Updated: 2026-09-10 03:34

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-67288.

CVE-2026-67288

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2026:62571

Open the full advisory

RHSA-2026:65855

Vulnerability from csaf_redhat - Published: 2026-09-09 09:03 - Updated: 2026-09-14 23:48

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-67288.

CVE-2026-67288

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 32 products

https://access.redhat.com/errata/RHSA-2026:65855

Open the full advisory

RHSA-2026:66281

Vulnerability from csaf_redhat - Published: 2026-09-10 02:04 - Updated: 2026-09-14 23:48

Summary

Red Hat Security Advisory: freerdp security update

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2026-67288.

CVE-2026-67288

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 32 products

https://access.redhat.com/errata/RHSA-2026:66281

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-67288 (GCVE-0-2026-67288)

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Vulnerability from osv_almalinux

Tags

Sightings

Nomenclature

Related by attack behaviour