FreeRDP CVE-2026-67304

The FreeRDP smartcard virtual channel must be active during session negotiation - this channel is enabled by default in many FreeRDP builds when a smartcard reader is present or when smartcard redirection is not explicitly disabled. No authentication is required (CVSS PR:N, UI:N), meaning exploitation can occur before credential exchange. The attacker must have TCP-level access to the RDP port (default 3389) of the FreeRDP process. Exploitation is strictly limited to denial of service (process crash); no code execution path has been identified. Non-default configurations that disable the smartcard virtual channel are not exploitable via this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this at the highest accessibility tier: network-reachable, low complexity, no authentication, no user interaction. The 8.7 score reflects the high availability impact (VA:H) with zero confidentiality or integrity exposure (VC:N/VI:N). In practice this means a single malformed packet can crash a FreeRDP session reliably, which is significant for environments relying on FreeRDP for remote access infrastructure. However, the blast radius per incident is a crashed session rather than a host compromise, meaningfully bounding real-world damage. EPSS data was not provided in the source intelligence, and the vulnerability carries no CISA KEV listing, indicating it has not been confirmed in active threat campaigns at time of analysis. No public proof-of-concept is identified, though the attack primitive (malformed IRP with mismatched cReaders) is straightforward to construct given the advisory detail. Overall priority: high for organizations running FreeRDP as a service endpoint, moderate for workstation-only deployments.

An attacker with network access to a listening FreeRDP endpoint initiates or intercepts an RDP session and injects a crafted smartcard device control request in which the cReaders field is set to a non-zero value while the reader-state payload is deliberately truncated. FreeRDP's decoder fails to parse the reader-state data and calls free_reader_states on an uninitialized null pointer, immediately crashing the process and terminating the remote desktop session. No authentication is required per the CVSS PR:N rating, making this exploitable from the pre-authentication phase of an RDP handshake wherever smartcard redirection is negotiated.