CVE-2026-109677
Description
A flaw was found in FreeRDP. This vulnerability allows information disclosure of client heap memory to a malicious Remote Desktop Protocol (RDP) server when a user connects to it. Due to improper bounds checking on smartcard pattern byte counts, the server can supply crafted data that triggers out-of-bounds memory reads and creates a timing oracle. By measuring query response times, an attacker can extract memory contents bit-by-bit to undermine memory protections like Address Space Layout Randomization (ASLR).
Statement
This flaw is rated Moderate because a malicious RDP peer can disclose heap memory contents via a smartcard ATR timing oracle from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.
Mitigation
If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
C:H disclosure only; UI:R → Moderate 6.5. Existing IMPORTANT impact corrected.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
