PT-2026-67268 · Freerdp · Freerdp

1121984919 · CVE-2026-67288 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description A null pointer dereference occurs in smartcard cache request decoders when they accept NULL NDR pointers for LookupName during SCARD IOCTL READCACHEA and SCARD IOCTL WRITECACHEA operations. If smartcard emulation is enabled, an attacker can send crafted smartcard cache requests with NULL lookup-name pointers to trigger the strlen() function on a null pointer, leading to the termination of the client process.

Recommendations Update to version 3.29.0 or later. Disable smartcard emulation to mitigate the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-67288

GHSA-PH3Q-F9W8-7JF3

Affected Products

Freerdp

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67288.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f · Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3 · Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f · Patch
• https://osv.dev/vulnerability/CVE-2026-67288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-67288 · Security Note
• https://vulncheck.com/advisories/freerdp-before-denial-of-service-via-smartcard-cache · Note