FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. (CVE-2026-67304)
FreeRDP versions prior to 3.29.0 contain a null pointer dereference vulnerability in the smartcard device control request cleanup process. This occurs when the reader-state decoding fails due to malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data. Exploitation leads to a process crash via null pointer access in the free_reader_states function. The vulnerability has a CVSS score of 7.5, indicating high severity, and does not impact confidentiality or integrity but causes denial of service.
AI Analysis
Technical Summary
The vulnerability in FreeRDP before version 3.29.0 is a null pointer dereference (CWE-476) triggered during smartcard device control request cleanup when reader-state decoding fails. Attackers can craft malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data, causing the free_reader_states function to dereference a null pointer and crash the process. This results in a denial of service condition. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity and no impact on confidentiality or integrity, but high impact on availability.
Potential Impact
Successful exploitation causes a denial of service by crashing the FreeRDP process due to null pointer dereference. There is no direct impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.
Mitigation Recommendations
A fix is available in FreeRDP version 3.29.0. Users should upgrade to version 3.29.0 or later to remediate this vulnerability. Patch status is confirmed by the versioning information in the description. No additional mitigations are specified.
FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. (CVE-2026-67304)
Description
FreeRDP versions prior to 3.29.0 contain a null pointer dereference vulnerability in the smartcard device control request cleanup process. This occurs when the reader-state decoding fails due to malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data. Exploitation leads to a process crash via null pointer access in the free_reader_states function. The vulnerability has a CVSS score of 7.5, indicating high severity, and does not impact confidentiality or integrity but causes denial of service.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in FreeRDP before version 3.29.0 is a null pointer dereference (CWE-476) triggered during smartcard device control request cleanup when reader-state decoding fails. Attackers can craft malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data, causing the free_reader_states function to dereference a null pointer and crash the process. This results in a denial of service condition. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity and no impact on confidentiality or integrity, but high impact on availability.
Potential Impact
Successful exploitation causes a denial of service by crashing the FreeRDP process due to null pointer dereference. There is no direct impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.
Mitigation Recommendations
A fix is available in FreeRDP version 3.29.0. Users should upgrade to version 3.29.0 or later to remediate this vulnerability. Patch status is confirmed by the versioning information in the description. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6x5p-r76q-h5g9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-67304"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6e6296bf32cb7a344f6a16
Added to database: 08/01/2026, 21:18:14 UTC
Last enriched: 08/01/2026, 21:23:39 UTC
Last updated: 08/01/2026, 21:57:54 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.