---
id: CVE-2026-109677
title: >-
  FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read
  vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern
  cbAtr byte count is not capped
summary: >-
  FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read
  vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern
  cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR
  mask arrays to use…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-125
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:31.583'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109677'
references:
  - url: >-
      https://github.com/FreeRDP/FreeRDP/commit/ececc5cbd0646ef012ca178322e6ef922a11f0c1
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m97-wwx3-r8vj'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/freerdp-2.0.0-beta1-before-3.28.0-out-of-bounds-read-via-locatecardsbyatra-handler
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T14:29:01.847Z'
---

## Overview

FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcard_LocateCardsByATRA_Call because the ATR pattern cbAtr byte count is not capped. Malicious RDP servers can send crafted ATR mask arrays to use query timing as an oracle, leaking heap memory bit-by-bit to defeat ASLR and aid RCE exploits.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.