CVE-2026-67304 FreeRDP CVE debrief

Who should care

System administrators and security teams responsible for FreeRDP installations should be aware of this vulnerability and take necessary actions to mitigate the risk. They should verify FreeRDP versions, checking for version 3.29.0 or later, and implement compensating controls, such as monitoring for suspicious smartcard device control requests. Additionally, they should restrict access to sensitive systems and data, and monitor for potential attacks and anomalies.

Technical summary

The CVE-2026-67304 vulnerability is a null pointer dereference in FreeRDP before 3.29.0. It occurs in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions. This vulnerability affects FreeRDP installations prior to version 3.29.0 and requires immediate attention from system administrators and security teams.

Defensive priority

High-priority defensive actions are required to address the null pointer dereference vulnerability in FreeRDP before 3.29.0.

Recommended defensive actions

• Inventory and verify FreeRDP versions, checking for version 3.29.0 or later.
• Implement compensating controls, such as monitoring for suspicious smartcard device control requests.
• Apply patches or updates from the vendor once available.
• Restrict access to sensitive systems and data.
• Monitor for potential attacks and anomalies.

Evidence notes

The CVE-2026-67304 record indicates a null pointer dereference vulnerability in FreeRDP before 3.29.0. The vulnerability is related to smartcard device control request cleanup when reader-state decoding fails. Limited information is available about the scope of affected systems and potential attack vectors. To verify and assess the vulnerability, defenders should review FreeRDP installations, check for version 3.29.0 or later, and monitor for suspicious smartcard device control requests.

Official resources