{"id":"CVE-2026-91945","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-91945","summary":"FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated…","details":"FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.","published":"2026-09-15T16:17:46.657","modified":"2026-09-15T16:17:46.657","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/FreeRDP/FreeRDP/commit/9626564421df72c84f891afdbc0b20bf702f369f","label":"FreeRDP/FreeRDP@9626564"},"references":[{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/commit/9626564421df72c84f891afdbc0b20bf702f369f"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-smartcard-atr"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q65v-4w7q-hx3r"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T16:17:46.657"}}