CVE-2026-67304CWE-476

CVE-2026-67304

High · published August 1, 2026

CVSS v3.1

7.5

EPSS

Percentile

50.6

In the wild

Unconfirmed

What it is

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00651 · 50.6th percentile
Weakness: CWE-476 · NULL Pointer Dereference
Published: 2026-08-01T17:16Z

Affected products (1)

Product	Versions	Fixed in
freerdp/freerdp	< 3.29.0	3.29.0

References (4)

https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5 · [email protected]https://www.vulncheck.com/advisories/freerdp-before-null-dereference-via-smartcard-cleanup · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

01 AUG 12:22Z
FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup
cvelistv5