Bug 2550533 (CVE-2026-109948)
| Summary: | CVE-2026-109948 freerdp: FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server with smartcard redirection enabled, the server can issue a crafted smartcard transmission request with an invalid card handle. Because FreeRDP fails to properly clear or restrict the response buffer upon encountering this error, uninitialized client memory is serialized and returned to the server. This issue allows a malicious server to access sensitive client heap data, resulting in information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2554024 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-13 13:57:21 UTC
|