CVE-2026-67288: FreeRDP Use-After-Free Vulnerability

CVE-2026-67288 Overview

CVE-2026-67288 is a null pointer dereference vulnerability in FreeRDP versions prior to 3.29.0. The flaw resides in the smartcard cache request decoders, which accept NULL Network Data Representation (NDR) pointers for the LookupName field in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations. When smartcard emulation is enabled on the FreeRDP client, a remote attacker controlling the RDP server can send crafted smartcard cache requests with NULL lookup-name pointers. This triggers a strlen() call on a null pointer, causing the client process to terminate. The vulnerability is tracked under CWE-476: NULL Pointer Dereference.

Critical Impact
A malicious RDP server can remotely crash any FreeRDP client with smartcard emulation enabled, resulting in denial of service without requiring authentication or user interaction.

Affected Products

FreeRDP versions prior to 3.29.0
FreeRDP clients with smartcard emulation enabled
Applications and distributions embedding vulnerable FreeRDP libraries

Discovery Timeline

2026-08-01 - CVE-2026-67288 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67288

Vulnerability Analysis

The vulnerability exists in FreeRDP's smartcard channel decoders that parse NDR-encoded RPC requests. Specifically, the SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA handlers deserialize a LookupName string pointer without validating whether the NDR referent pointer is NULL. FreeRDP then passes this pointer directly to strlen(), which dereferences it unconditionally. When the pointer is NULL, the client process crashes with a segmentation fault. Because the smartcard virtual channel is bidirectional, a malicious or compromised RDP server can craft the malformed IOCTL and deliver it after channel negotiation.

Root Cause

The root cause is missing input validation in the NDR unmarshaling routine for ANSI smartcard cache IOCTLs. NDR permits referent pointers to be NULL to indicate absent optional fields, but the FreeRDP decoders treated the LookupName field as always populated. No null check preceded the strlen() invocation on the decoded string, violating defensive programming practices for untrusted network input.

Attack Vector

The attack is remote and requires no authentication or user interaction beyond initiating an RDP session to an attacker-controlled server. Once the client connects and negotiates the smartcard virtual channel, the server sends a crafted SCARD_IOCTL_READCACHEA or SCARD_IOCTL_WRITECACHEA packet with a NULL NDR referent for LookupName. The client decodes the request, calls strlen(NULL), and terminates. The impact is limited to availability of the client process; there is no confidentiality or integrity compromise.

text

// Patch reference from FreeRDP release commit
// Source: https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f

function(get_project_version VERSION_MAJOR VERSION_MINOR VERSION_REVISION VERSION_SUFFIX GIT_REVISION)

  # Default version, hard codec per release
- set(RAW_VERSION_STRING "3.27.2-dev0")
+ set(RAW_VERSION_STRING "3.28.0")

  set(VERSION_REGEX "^(.*)([0-9]+)\\.([0-9]+)\\.([0-9]+)-?(.*)")

The fix is delivered as part of the FreeRDP 3.29.0 release. Additional hardening in adjacent path-handling code was introduced in FreeRDP commit f3b4347.

Detection Methods for CVE-2026-67288

Indicators of Compromise

Unexpected termination or segmentation fault of FreeRDP client processes (xfreerdp, wlfreerdp, sdl-freerdp) shortly after connecting to a remote host
Core dumps referencing strlen frames within smartcard channel decoding functions
RDP sessions to untrusted or newly observed servers that immediately terminate the client

Detection Strategies

Inventory endpoints running FreeRDP builds earlier than 3.29.0 and flag those with smartcard redirection enabled in configuration
Monitor process crash telemetry for FreeRDP binaries and correlate with outbound TCP/3389 or TCP/443 RDP connections
Inspect RDP virtual channel traffic for SCARD_IOCTL_READCACHEA (0x000900AC) and SCARD_IOCTL_WRITECACHEA (0x000900B4) messages containing NULL NDR referents

Monitoring Recommendations

Alert on repeated FreeRDP client crashes affecting the same user or workstation within short time windows
Log outbound RDP connections from workstations and correlate with crash events to identify malicious servers
Track deployment of FreeRDP updates across managed Linux and Unix endpoints where the client is commonly used

How to Mitigate CVE-2026-67288

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all affected endpoints and rebuild any downstream packages that statically link the library
Disable smartcard emulation and redirection in FreeRDP client configurations where the feature is not required
Restrict outbound RDP connectivity to trusted, authenticated servers using firewall rules or a jump host

Patch Information

The issue is fixed in FreeRDP 3.29.0. The upstream release bump is visible in FreeRDP commit 5370fb2, and coordinated details are published in the FreeRDP GHSA-ph3q-f9w8-7jf3 advisory and the VulnCheck advisory for smartcard cache denial of service.

Workarounds

Launch FreeRDP without the /smartcard or /smartcard-logon command-line options until patched builds are deployed
Block or proxy outbound RDP traffic to unverified destinations via egress firewall policy
Segment workstations that must use FreeRDP with smartcard redirection so they can only reach authorized internal RDP hosts

bash

# Verify installed FreeRDP version and disable smartcard redirection at invocation
xfreerdp --version

# Connect without smartcard channel until upgrading to 3.29.0 or later
xfreerdp /v:rdp.internal.example.com /u:alice /cert:tofu