CVE-2026-109940
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider.
Published Oct 13, 2026 · updated Oct 14, 2026
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client's stack during key enumeration, causing a crash.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
Oct 14, 2026 · Catalog
Fix available
Debian:14 freerdp3 0 → 3.32.0+dfsg-1
Oct 14, 2026 · Catalog
Updated
Oct 14, 2026 · NIST NVD
Updated
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a malicious PKCS#11 token or module whose key and matching certificate use a 55- to 64-byte CKA_ID can overflow the client'
Affected
- Debian:12 freerdp22.10.0+dfsg1-1, 2.10.0+dfsg1-1.1, 2.11.2+dfsg1-1
- Debian:13 freerdp33.15.0+dfsg-2.1, 3.15.0+dfsg-2.1+deb13u1, 3.15.0+dfsg-2.1+deb13u2
- Debian:14 freerdp30 → 3.32.0+dfsg-1
Sources
- CVE.orgCVE-2026-109940
Official CVE identifier
cve.org - NIST NVDCVE-2026-109940
FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider. It hex-encodes a key's CKA_ID, which can be up to 64 bytes, into a fixed 128-byte stack buffer. An attacker supplying a m
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-109940osv.dev