FreeRDP EUVD-2026-97694

Exploitation requires the FreeRDP client (3.0.0 through 3.31.x) to be configured for smartcard logon using the PKCS#11 backend, and the attacker must control the smartcard token presented during authentication - specifically a token that exposes more than 64 public key objects across its slots, with attacker-chosen CKA_ID and CKA_LABEL attribute values. Limiting factors are significant: the attack vector is PHYSICAL (the malicious token must be physically presented to the machine), active user interaction is required (the victim must initiate smartcard logon), and deployments not using PKCS#11 smartcard authentication are unaffected. These constraints confine realistic risk to shared, kiosk, or physically accessible systems where untrusted tokens can be introduced.

This is a genuine but constrained vulnerability, not a mass-exploitation priority. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:A) describes a PHYSICAL attack vector requiring active user interaction - the victim must initiate a smartcard logon with an attacker-controlled PKCS#11 token presenting more than 64 public key objects. High impact across confidentiality, integrity and availability (VC:H/VI:H/VA:H) reflects heap corruption that can plausibly lead to code execution in the FreeRDP client process, justifying the 7.0 base score. However, real-world risk is dampened by the physical/local prerequisite: an attacker must supply or substitute the smartcard hardware the user authenticates with, so this is a targeted, hands-on-device scenario rather than remotely scalable. No EPSS score, KEV listing, or POC was provided in the input, and no public exploit identified at time of analysis - all consistent with low expected weaponization. There is no conflicting signal here; the physical vector and lack of exploitation intelligence align. Prioritize patching for environments where untrusted smartcards or hardware tokens may be used (kiosks, shared workstations), and treat it as lower urgency where token provenance is controlled.

An attacker supplies or substitutes a malicious PKCS#11 smartcard token (e.g., at a shared or kiosk workstation) that enumerates more than 64 public key objects across multiple slots. When the victim initiates FreeRDP smartcard logon, collect_keys() writes past its fixed 64-entry array, corrupting the heap with attacker-chosen CKA_ID and CKA_LABEL data, potentially leading to code execution in the client. No public exploit code is known at time of analysis.