PT-2026-22016 · Freerdp+2 · Freerdp+2

Ppcavalcante · Published 2026-01-01 · Updated 2026-04-25 · CVE-2026-27015

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description A missing bounds check in the smartcard unpack read size align() function within libfreerdp/utils/smartcard pack.c can cause the FreeRDP client to crash when connecting to a malicious RDP server. This crash is triggered by a reachable WINPR ASSERT leading to an abort() condition. The issue occurs in builds where WITH VERBOSE WINPR ASSERT is enabled, which is the default setting in FreeRDP 3.22.0 and current WinPR CMake configurations. To be affected, smartcard redirection must be explicitly enabled by the user, for example, using the /smartcard option or /smartcard-logon.

Recommendations Update to FreeRDP version 3.23.0 or later.

Exploit

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2026-04155

CVE-2026-27015

GHSA-7G72-39PQ-4725

OESA-2026-1516

OESA-2026-1517

OESA-2026-1518

OESA-2026-1519

OESA-2026-1520

OESA-2026-1521

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Ubuntu

References · 95

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27015.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/65d59d3b3c2f630f2ea862687ecf5f95f8115244 · Patch
• https://ubuntu.com/security/CVE-2026-23732 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24676 · Security Note
• https://ubuntu.com/security/CVE-2026-27951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27015 · Security Note
• https://ubuntu.com/security/CVE-2026-22858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24681 · Security Note
• https://ubuntu.com/security/CVE-2026-22852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24683 · Security Note
• https://ubuntu.com/security/CVE-2026-23531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22857 · Security Note