CVE-2026-67304: 
Wolfi vulnerability analysis and mitigation

CVE-2026-67304 is a NULL pointer dereference vulnerability in FreeRDP's smartcard device control request cleanup that allows unauthenticated remote attackers to crash the FreeRDP process. It affects all FreeRDP versions prior to 3.29.0 (confirmed through release 3.28.0). The vulnerability was discovered by Bin Luo of the University of Electronic Science and Technology of China (UESTC) and disclosed on August 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is a NULL pointer dereference (CWE-476) in the free_reader_states_a() and free_reader_states_w() helper functions in libfreerdp/utils/smartcard_operations.c. Several smartcard IRP request parsers — including those handling SCARD_IOCTL_GETSTATUSCHANGEA/W, SCARD_IOCTL_LOCATECARDSA/W, and SCARD_IOCTL_LOCATECARDSBYATRA/W — read a remote-controlled cReaders value before decoding rgReaderStates. If reader-state decoding fails, rgReaderStates remains NULL while cReaders retains its non-zero value; subsequent cleanup via smartcard_operation_free() then calls free_reader_states_a/w(NULL, cReaders), which indexes rgReaderStates[x] without a NULL guard, causing a segmentation fault. The vulnerability is exploitable over the network without authentication or user interaction, affecting both the FreeRDP client smartcard path (channels/smartcard/client/smartcard_main.c) and the FreeRDP proxy smartcard path (server/proxy/channels/pf_channel_smartcard.c) (FreeRDP Advisory).

Successful exploitation results in a reliable process crash (denial of service) with no evidence of code execution potential. In the client scenario, a malicious or compromised RDP server can crash a FreeRDP client when smartcard redirection is enabled; in the proxy scenario, a malicious client can crash the FreeRDP proxy's smartcard handling channel. There is no confidentiality or integrity impact — the confirmed effect is solely availability loss (FreeRDP Advisory, GitHub Advisory).

1. Identify target: Locate a FreeRDP client (version ≤ 3.28.0) with smartcard redirection enabled, or a FreeRDP proxy with the smartcard interception path active, reachable over the network.
2. Craft malformed IRP request: Construct a smartcard Device Control IRP targeting one of the vulnerable IOCTLs (e.g., SCARD_IOCTL_GETSTATUSCHANGEA, SCARD_IOCTL_LOCATECARDSA, or SCARD_IOCTL_LOCATECARDSBYATRA). Set cReaders to a non-zero value (e.g., 1) and include a non-NULL NDR pointer for rgReaderStates, but truncate the reader-state array body so that decoding fails.
3. Send the request: Deliver the malformed IRP to the target FreeRDP client (acting as a malicious RDP server) or to the FreeRDP proxy (acting as a malicious RDP client).
4. Trigger NULL dereference: The decode failure leaves rgReaderStates as NULL while cReaders remains non-zero. Cleanup via smartcard_operation_free() calls free_reader_states_a/w(NULL, cReaders), which dereferences rgReaderStates[0] and crashes the process with a segmentation fault (exit code 139) (FreeRDP Advisory).

• Process: FreeRDP client or proxy process terminating unexpectedly with exit code 139 (SIGSEGV); crash dumps referencing free_reader_states_a or free_reader_states_w in libfreerdp/utils/smartcard_operations.c at lines 1502 or 1513.
• Logs: ASan-enabled builds will log AddressSanitizer: SEGV on unknown address 0x000000000000 with a stack trace showing free_reader_states_a/w → smartcard_operation_free → smartcard_process_irp or pf_channel_smartcard_client_handle.
• Network: Repeated RDP smartcard IRP Device Control requests with anomalous or truncated reader-state payloads targeting the affected IOCTL codes (SCARD_IOCTL_GETSTATUSCHANGEA/W, SCARD_IOCTL_LOCATECARDSA/W, SCARD_IOCTL_LOCATECARDSBYATRA/W) from an unexpected source (FreeRDP Advisory).

Upgrade FreeRDP to version 3.29.0 or later, which contains the fix for this vulnerability (GitHub Advisory). The suggested fix direction is to add a NULL guard in free_reader_states_a/w() so that the function returns immediately when rgReaderStates is NULL, or to clear cReaders before returning a decode failure when rgReaderStates has not been assigned. As a network-level workaround, restrict smartcard device redirection and IRP requests to trusted sources only using firewall rules or RDP gateway policies (FreeRDP Advisory).