CVE-2026-67304: FreeRDP Null Pointer Dereference DoS Flaw

CVE-2026-67304 Overview

CVE-2026-67304 is a null pointer dereference vulnerability [CWE-476] in FreeRDP versions before 3.29.0. The flaw resides in the smartcard device control request cleanup path, specifically the free_reader_states functions. When reader-state decoding fails, the cleanup routine dereferences an uninitialized or null pointer. Attackers send malformed smartcard I/O Request Packets (IRPs) with a non-zero cReaders count and truncated reader-state data. Processing these crafted packets crashes the FreeRDP process, resulting in denial of service against clients or gateways that rely on smartcard channel redirection.

Critical Impact
Remote unauthenticated attackers can trigger a process crash in FreeRDP by delivering malformed smartcard IRP requests, disrupting Remote Desktop Protocol (RDP) sessions and smartcard redirection.

Affected Products

FreeRDP versions prior to 3.29.0
Applications and distributions embedding vulnerable FreeRDP libraries with smartcard redirection enabled
RDP clients and gateways using FreeRDP's smartcard channel

Discovery Timeline

2026-08-01 - CVE-2026-67304 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67304

Vulnerability Analysis

The vulnerability affects FreeRDP's smartcard virtual channel handler. Smartcard redirection uses PC/SC-like control requests carried inside RDP Device I/O Request Packets. Each request encodes a cReaders field describing how many reader-state entries follow. FreeRDP allocates an array to hold decoded reader states, then invokes decoding routines to populate it. When decoding fails on truncated input, control passes to cleanup helpers named free_reader_states. These helpers iterate through the array and free per-entry members without validating that entries were successfully initialized. The result is a dereference of null or garbage pointers during teardown, terminating the process.

Root Cause

The root cause is missing initialization and pointer validation in the error path of smartcard reader-state decoding. The allocated reader-state array is not zero-initialized before decoding begins, and the cleanup routine assumes every slot up to cReaders contains a valid, fully constructed entry. Truncated input causes decoding to abort partway, leaving later slots in an indeterminate state that the cleanup function still processes.

Attack Vector

An unauthenticated network attacker able to inject data into the RDP smartcard channel can trigger the crash. The attacker sends a smartcard IRP whose cReaders value exceeds the number of complete reader-state records actually present in the payload. The decode routine fails on the truncated tail, and the ensuing cleanup dereferences an uninitialized pointer. No authentication or user interaction is required for the code path itself once channel data is delivered.

Related hardening from the same upstream security effort touches clipboard handling in client/Windows/wf_cliprdr.c, where response structures are now zero-initialized and length fields are validated:

 	else if (!ResetEvent(clipboard->req_fevent))
 		rc = ERROR_INTERNAL_ERROR;
 
+	if (nreq != clipboard->req_fsize)
+		rc = ERROR_INVALID_DATA;
 	return rc;
 }
 
 static UINT cliprdr_send_response_filecontents(wfClipboard* clipboard, UINT32 streamId, UINT32 size,
                                                BYTE* data)
 {
-	CLIPRDR_FILE_CONTENTS_RESPONSE fileContentsResponse;
+	CLIPRDR_FILE_CONTENTS_RESPONSE fileContentsResponse = WINPR_C_ARRAY_INIT;
 
 	if (!clipboard || !clipboard->context || !clipboard->context->ClientFileContentsResponse)
 		return ERROR_INTERNAL_ERROR;

Source: FreeRDP commit 1cc783d. The same defensive pattern — zero-initialize structures and validate size fields before use — is applied to the smartcard cleanup path.

Detection Methods for CVE-2026-67304

Indicators of Compromise

Unexpected FreeRDP process termination or SIGSEGV crash logs on hosts running RDP clients or gateways
Core dumps referencing free_reader_states or the smartcard virtual channel in the call stack
Repeated RDP session drops from a single remote source targeting the smartcard channel

Detection Strategies

Inspect RDP virtual channel traffic for smartcard IRPs where the declared cReaders count does not match the remaining payload length
Alert on FreeRDP binaries (xfreerdp, wfreerdp, embedded libraries) exiting abnormally shortly after a new RDP connection
Correlate crash telemetry with network flows on TCP 3389 or RDP gateway ports to identify malicious peers

Monitoring Recommendations

Enable core dump collection and crash reporting on hosts running FreeRDP-based clients or brokers
Forward application and system crash events into a centralized data lake for pattern analysis across hosts
Track FreeRDP version inventory across endpoints and servers to identify systems still below 3.29.0

How to Mitigate CVE-2026-67304

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all clients, gateways, and applications that embed the library
Audit downstream packages and container images for bundled FreeRDP versions and rebuild against the fixed release
Restrict inbound RDP connectivity to trusted networks and enforce mutual authentication at the gateway

Patch Information

The fix is available in FreeRDP 3.29.0. Review the upstream GitHub Security Advisory GHSA-78jj-45vh-jpm5, the FreeRDP commit 1cc783d, and the VulnCheck Advisory for FreeRDP for full technical context and package guidance.

Workarounds

Disable smartcard channel redirection at the RDP client or gateway configuration until patched builds are deployed
Terminate RDP sessions from untrusted sources at a network proxy or RDP gateway that validates channel payloads
Isolate hosts requiring smartcard redirection on dedicated network segments with strict source filtering

bash

# Disable the smartcard virtual channel when launching xfreerdp
# Omit /smartcard and explicitly disable device redirection
xfreerdp /v:rdp.example.com /u:user +clipboard -smartcard /cert:ignore

# Verify installed FreeRDP version meets or exceeds 3.29.0
xfreerdp --version