FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed… (CVE-2026-109250)

The vulnerability in FreeRDP 3.0.0 before 3.32.0 is a heap buffer overflow in the collect_keys() function. It arises because the function does not properly limit the number of keys enumerated from PKCS#11 smartcard tokens, allowing local attackers to exceed the fixed 64-entry keys array. This overflow enables memory corruption by writing attacker-controlled CKA_ID and CKA_LABEL data into heap memory during smartcard logon, potentially leading to code execution or denial of service.

Successful exploitation allows local attackers with control over smartcard tokens to corrupt heap memory, potentially resulting in arbitrary code execution, privilege escalation, or denial of service during smartcard logon. The CVSS score of 6.6 (High) reflects the significant confidentiality, integrity, and availability impacts.

A fix is available in FreeRDP version 3.32.0. Users should upgrade to version 3.32.0 or later to remediate this vulnerability. No additional mitigations are indicated.