CVE-2026-91945

A flaw was found in FreeRDP. Authenticated RDP clients can exploit an out-of-bounds read vulnerability in smartcard response decoders. This occurs because the decoders fail to validate the length of Answer to Reset (ATR) fields against fixed inline arrays. By sending oversized ATR lengths, an attacker can trigger reads past memory objects, leading to process termination and a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable smartcard redirection when connecting to RDP servers using FreeRDP. This can typically be achieved by using the --disable-smartcard command-line option for xfreerdp or similar configuration in other FreeRDP-based clients. Disabling smartcard redirection may impact functionality that relies on smartcard authentication or access within the RDP session.