CVE-2026-109948
Description
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server with smartcard redirection enabled, the server can issue a crafted smartcard transmission request with an invalid card handle. Because FreeRDP fails to properly clear or restrict the response buffer upon encountering this error, uninitialized client memory is serialized and returned to the server. This issue allows a malicious server to access sensitive client heap data, resulting in information disclosure.
Statement
This flaw is rated Moderate because a malicious RDP peer can disclose uninitialized client memory via smartcard SCardTransmit from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.
Mitigation
If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Red Hat CVSS v3 Score Explanation
Red Hat CVSS reflects FreeRDP exposure after applying client/server interaction model. Score 4.3 maps to MODERATE.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
