Bug 2560936

Summary: CVE-2026-109940 freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name [fedora-43]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: freerdpAssignee: Simone Caronni <negativo17>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 43CC: dasfilter, negativo17, ngompa13, oholy
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["fb75f5d9-c0ea-4b50-b946-fa9dc564d50a"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-02 13:55:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2550524    

Description Srikanth Balasubramanian 2026-10-26 16:40:08 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash.
Comment 1 Ondrej Holy 2026-11-02 13:55:58 UTC 
This issue is fixed in FreeRDP 3.32.0. Fedora currently ships freerdp 3.32.2 in all supported branches (F43, F44, F45 and Rawhide), so this flaw is no longer present. Closing as ERRATA.