CVE-2026-109940

A flaw was found in FreeRDP. An attacker who supplies a malicious or compromised Public-Key Cryptography Standards (PKCS#11) token can cause a Denial of Service (DoS) by crashing the client application. During key enumeration, FreeRDP processes key identifier attributes into a fixed-size stack buffer without adequate bounds checking. Presenting a token with an oversized key identifier triggers a stack-based buffer overflow, causing the application to terminate unexpectedly.

This flaw is rated Moderate because a stack buffer overflow in the PKCS#11 key-name path can crash FreeRDP. The attack requires a local/physical token interaction model reflected in AV:P and user involvement (UI:R). Impact is availability-only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If PKCS#11 smartcard/token support is unused, disable or avoid PKCS#11 providers in FreeRDP. Restrict token use to trusted environments.