CVE-2026-109677

A flaw was found in FreeRDP. This vulnerability allows information disclosure of client heap memory to a malicious Remote Desktop Protocol (RDP) server when a user connects to it. Due to improper bounds checking on smartcard pattern byte counts, the server can supply crafted data that triggers out-of-bounds memory reads and creates a timing oracle. By measuring query response times, an attacker can extract memory contents bit-by-bit to undermine memory protections like Address Space Layout Randomization (ASLR).

This flaw is rated Moderate because a malicious RDP peer can disclose heap memory contents via a smartcard ATR timing oracle from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.