CVE-2026-91945

Executive Summary

CVE-2026-91945 is an out-of-bounds read vulnerability in FreeRDP versions before 3.31.0, specifically within smartcard response decoders that fail to validate ATR (Answer To Reset) length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses, causing reads past stack or heap objects and resulting in process termination. This vulnerability primarily impacts availability, as successful exploitation leads to a denial-of-service condition on the affected FreeRDP client or server process. The CVSS score of 6.5 reflects a medium-severity issue with high availability impact, requiring authenticated access and local attack complexity.

Technical Analysis

The vulnerability resides in the smartcard response decoding logic of FreeRDP. Per the NVD description, the flaw is an out-of-bounds read (CWE-125) that occurs when the decoder processes ATR length fields without validating them against fixed inline arrays. ATR is a data structure used in smartcard communication to convey information about the card's characteristics. In the context of FreeRDP's smartcard redirection over RDP, a client can send a PAKID_CORE_DEVICE_IOCOMPLETION response containing an ATR with an oversized length field. The decoder, expecting the ATR length to fit within a pre-allocated inline array, does not perform bounds checking. As a result, the decoder reads beyond the bounds of the stack or heap object, leading to a process termination due to memory access violation. The attack surface is the RDP protocol's smartcard device redirection channel. The vulnerability requires the attacker to be an authenticated RDP client, meaning they must have valid credentials or have compromised an RDP session. The out-of-bounds read does not typically allow code execution, as it is a read operation; the primary impact is denial of service.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies an RDP service (default port 3389) that supports smartcard redirection and is running a vulnerable version of FreeRDP (before 3.31.0). This could be a FreeRDP client connecting to a malicious server, or a FreeRDP-based server (e.g., xrdp with FreeRDP) accepting client connections.

2. Triggering the flaw: The attacker, after authenticating to the RDP session, sends a crafted PAKID_CORE_DEVICE_IOCOMPLETION response containing an ATR with a length field that exceeds the size of the fixed inline array used by the decoder. This response is part of the smartcard device redirection protocol.

3. Payload/execution method: The payload is a malformed smartcard response. No public PoC is available; the attack chain is inferred from the vulnerability class. The attacker must be able to send arbitrary smartcard responses, which typically requires control over the client or server endpoint in the RDP connection. For a malicious server attacking a FreeRDP client, the server can send the crafted response during the smartcard redirection negotiation. For a malicious client attacking a FreeRDP server, the client can send the malformed response after authentication.

4. Post-exploitation impact: The out-of-bounds read causes the FreeRDP process to terminate, resulting in a denial of service. There is no evidence of data exfiltration or code execution. The impact is limited to availability; the process crash may disrupt the RDP session and any dependent services.

Impact Assessment

The vulnerability has a CVSS score of 6.5, with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates a network-accessible attack (AV:N), low attack complexity (AC:L), requiring low privileges (PR:L), with no user interaction (UI:N). The scope is unchanged (S:U), and there is no confidentiality (C:N) or integrity (I:N) impact, but a high availability impact (A:H). The business impact is primarily disruption of RDP services that use FreeRDP for smartcard redirection. Organizations relying on FreeRDP for remote access with smartcard authentication may experience session crashes, leading to loss of productivity and potential operational delays. The blast radius is limited to the affected FreeRDP process; however, if the process is a critical gateway, it could affect multiple users. The EPSS score is low (0.00567, 45.5th percentile), suggesting a low probability of exploitation in the wild at this time. No CISA KEV entry, no public PoC, and no known exploit code are available.

Detection Guidance

Sigma Rule

title: FreeRDP Smartcard ATR Out-of-Bounds Read Attempt
id: 5f8c9d2e-1a3b-4c5d-6e7f-8a9b0c1d2e3f
status: experimental
description: Detects potential exploitation of CVE-2026-91945 via malformed smartcard ATR in RDP traffic
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\FreeRDP.exe'
    CommandLine|contains: 'smartcard'
  condition: selection
falsepositives:
  - Legitimate smartcard usage
level: medium
tags:
  - attack.t1190
  - cve.2026.91945

YARA Rule

rule CVE_2026_91945_FreeRDP_ATR_OOB
{
    meta:
        description = "Detects FreeRDP versions vulnerable to CVE-2026-91945"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91945"
        hash = "unknown"
    strings:
        $version = "FreeRDP" ascii wide nocase
        $vuln_indicator = "PAKID_CORE_DEVICE_IOCOMPLETION" ascii wide
    condition:
        $version and $vuln_indicator
}

Suricata IDS Rule

alert tcp any any -> any 3389 (msg:"CVE-2026-91945 FreeRDP Smartcard ATR Out-of-Bounds Read Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"PAKID_CORE_DEVICE_IOCOMPLETION"; nocase; content:"ATR"; nocase; within:100; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-91945; classtype:attempted-dos; sid:1000001; rev:1;)

Elastic Detection

process where process.name == "FreeRDP.exe" and process.command_line : "*smartcard*"

Splunk SPL Query

index=main sourcetype=WinEventLog:Security EventCode=4624 LogonType=10 
| search "FreeRDP" 
| stats count by src_ip, dest, user 
| where count > 0

Wazuh OSSEC Rule

<group name="freerdp,">
  <rule id="100200" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">FreeRDP smartcard ATR oversized</field>
    <description>CVE-2026-91945: FreeRDP smartcard ATR out-of-bounds read attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix).

1. Immediate mitigations: Disable smartcard redirection in FreeRDP if not required. Restrict RDP access to trusted networks and enforce strong authentication. Monitor for process crashes of FreeRDP.
2. Patch/upgrade steps: Upgrade FreeRDP to version 3.31.0 or later. For Debian-based systems, apply the latest security updates from Debian repositories. Verify the fix by checking the version string.
3. Long-term hardening: Implement input validation for all protocol fields, including length checks. Use memory-safe languages or bounds-checking libraries. Conduct regular security audits of RDP-related components. Enable logging and alerting for anomalous smartcard responses.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91945
• OSV: https://osv.dev/vulnerability/CVE-2026-91945
• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-91945
• FreeRDP GitHub: https://github.com/FreeRDP/FreeRDP
• CWE-125: https://cwe.mitre.org/data/definitions/125.html

No known threat actor campaigns or exploit-in-the-wild evidence at this time.