CVE-2026-109940 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP deployments should assess exposure and prioritize verification and remediation. This includes operators managing Unix-based systems with PKCS#11 support, vulnerability management teams, and security teams overseeing FreeRDP configurations.

Why it matters

Defenders should prioritize verifying FreeRDP versions and updating to 3.32.0 or later if vulnerable, as a stack-based buffer overflow vulnerability exists in FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support.

• Potential stack overflow during key enumeration
• Crash of the FreeRDP client during key enumeration

Technical summary

The vulnerability is caused by the wprintKeyName() function in WinPR's NCrypt PKCS#11 provider, which hex-encodes a key's CKA_ID into a fixed 128-byte stack buffer. An attacker can supply a malicious PKCS#11 token or module with a key and matching certificate using a 55- to 64-byte CKA_ID to overflow the client's stack during key enumeration, causing a crash. This issue affects FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support, impacting defenders who manage FreeRDP deployments and need to assess exposure.

Defensive priority

Defenders should prioritize verifying FreeRDP versions and updating to 3.32.0 or later if vulnerable.

Recommended defensive actions

• Verify FreeRDP versions and update to 3.32.0 or later if vulnerable
• Review and restrict access to PKCS#11 tokens or modules
• Monitor for suspicious activity related to FreeRDP
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program record and the NVD vulnerability detail page. The affected versions are FreeRDP 3.0.0-beta1 before 3.32.0. Defenders should verify FreeRDP versions and assess exposure. Evidence is limited to public CVE details and NVD analysis; further verification is needed for complete impact assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.