CVE-2026-67304: Freerdp

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

Affected products

• Freerdp Freerdp: before 3.29.0 (fixed in 3.29.0)

Published 2026-08-01. Last modified 2026-09-08.