FreeRDP EUVD-2026-98705

Exploitation requires a FreeRDP client (version 3.0.0-beta1 up to but not including 3.32.0) built on Unix WITH PKCS#11 support enabled - a non-default/optional build configuration. The attacker must supply a malicious PKCS#11 token or module containing a key AND matching certificate that both use a CKA_ID between 55 and 64 bytes, and the victim must initiate key enumeration (typically smart-card authentication). Limiting factors: the physical attack vector (attacker-controlled token/module must reach the victim), the requirement for user interaction to trigger enumeration, and the non-default PKCS#11 build requirement all substantially narrow real-world exploitability; impact is confined to a client-side crash.

This is a genuinely low-priority issue despite the CWE-121 stack-overflow classification. The authoritative CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 5.1 (MEDIUM) and tells a consistent story: the attack vector is PHYSICAL (AV:P), user interaction is required (UI:P), and the only impact is availability (VA:H) - the advisory itself describes the outcome merely as 'causing a crash,' not code execution. Although CWE-121 stack overflows are often a stepping stone to RCE, both the vendor description and the CVSS impact metrics explicitly limit this to a denial-of-service/crash, with no confidentiality or integrity impact. No KEV listing, no EPSS score, and no POC were provided in the intelligence, so exploitation is: no public exploit identified at time of analysis. The physical attack vector plus the requirement for a FreeRDP build with PKCS#11 support and victim-initiated key enumeration make real-world exploitation narrow and targeted rather than widespread. One caveat to verify: the overflow writes attacker-controlled hex data onto the stack, so RCE cannot be fully ruled out on builds without stack protections - but the vendor and CVSS both assess impact as availability-only, and that assessment should be trusted absent contrary evidence.

An attacker presents a malicious PKCS#11 token (e.g., a rogue smart card) or convinces a user to load a hostile PKCS#11 module containing a key and matching certificate whose CKA_ID is 55-64 bytes long. When the FreeRDP client enumerates keys on the token (such as during smart-card logon), wprintKeyName() hex-encodes the oversized CKA_ID into a fixed 128-byte stack buffer, overflowing it and crashing the client. No public exploit code was identified in the provided data.