Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-67304 Details

Description

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5 CISA-ADPExploitVendor Advisory
https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 [email protected]Patch
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78jj-45vh-jpm5 [email protected]ExploitVendor Advisory
https://www.vulncheck.com/advisories/freerdp-before-null-dereference-via-smartcard-cleanup [email protected]PatchThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-476NULL Pointer Dereference[email protected]

Affected Products

ProductVersions
freerdp freerdp
< 3.29.0

CPE

  • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-67304
NVD Published Date:
Aug 1, 2026
NVD Last Modified:
Sep 8, 2026
Source:
[email protected]
CVE-2026-67304 Details - Not Deferred