Medium [CVE-2026-67288] Denial of Service via crafted smartcard cache requests

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations.

When smartcard emulation is enabled, attackers can send crafted smartcard cache requests with NULL lookup-name pointers to trigger strlen() on a null pointer, causing client process termination. A flaw was found in FreeRDP.

This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions. A Moderate denial of service flaw affects FreeRDP in Red Hat products.

When smartcard emulation is enabled, a remote attacker can exploit this vulnerability by sending malformed smartcard cache requests, leading to a null pointer dereference and subsequent termination of the FreeRDP client process. This can disrupt active remote desktop sessions for affected users.

Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 6 more.