FreeRDP CVE-2026-109677

Exploitation requires the victim to initiate an RDP session to an attacker-controlled or compromised server (direction is server-attacks-client, matching UI:P), and the client must have smartcard device redirection negotiated so the LocateCardsByATRA handler is reachable to process the malicious LocateCards_ATRMask array. The specific trigger is a LocateCards_ATRMask (or SCARD_READERSTATEA/W) whose cbAtr exceeds the fixed 36-byte rgbAtr/rgbMask buffers, which the pre-patch code did not cap. Limiting factors: no code execution is direct (confidentiality-only leak), the attack needs repeated timing-oracle queries to extract memory, smartcard redirection must be in use, and the user must actively connect - so default clients that never enable smartcard redirection or never connect to hostile servers are not exposed.

This is a client-side out-of-bounds read in FreeRDP's smartcard channel (CVE-2026-109677), where a malicious or compromised RDP server abuses an uncapped cbAtr byte count in smartcard_LocateCardsByATRA_Call to read past the fixed 36-byte rgbAtr/rgbMask arrays and leak heap memory bit-by-bit via a query-timing oracle. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) for 7.1 is directionally consistent with the description: network reach, low complexity, no attacker-side privileges, but passive user interaction is required (the victim must initiate a connection to the attacker's server) and impact is confidentiality-only. No EPSS score, KEV listing, or public POC was supplied; exploitation status is therefore 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. The realistic risk is a sophisticated information-disclosure primitive that defeats ASLR to enable follow-on RCE - serious as a building block, but it is reversed-direction (server attacks client), needs the smartcard redirection channel to be reachable, and depends on the victim connecting to a hostile server, so it is a lower operational priority than an unauthenticated server-side RCE despite the memory-disclosure severity. Confidentiality impact rated high reflects a controllable, repeatable heap-read oracle rather than a one-shot leak.

An attacker stands up or compromises an RDP server and lures a FreeRDP-based client (with smartcard redirection active) into connecting to it. The malicious server returns crafted LocateCards_ATRMask structures with an oversized cbAtr, then uses the timing of ATR mask comparison queries as an oracle to read adjacent heap memory bit-by-bit, recovering pointers to defeat ASLR and chain toward remote code execution. No public exploit code was identified in the provided data, though the vendor commit ships a unit test that reproduces the over-range cbAtr condition.