CVE-2026-27015
📋 TL;DR
A missing bounds check in FreeRDP's smartcard handling allows a malicious RDP server to crash the FreeRDP client via an assertion failure. This affects FreeRDP users who explicitly enable smartcard redirection when connecting to untrusted RDP servers. The vulnerability requires user interaction to enable the vulnerable feature.
💻 Affected Systems
- FreeRDP
📦 What is this software?
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing client application crash, potentially disrupting remote access sessions and causing data loss in unsaved work.
Likely Case
Client crash when connecting to a malicious RDP server with smartcard redirection enabled, requiring restart of the FreeRDP client.
If Mitigated
No impact if smartcard redirection is disabled or if connecting only to trusted RDP servers.
🎯 Exploit Status
Exploitation requires the client to connect to a malicious RDP server with smartcard redirection enabled. The server must craft a malicious smartcard response.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.23.0
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725
Restart Required: Yes
Instructions:
1. Update FreeRDP to version 3.23.0 or later. 2. For package managers: Use your distribution's update command (apt update && apt upgrade freerdp2, yum update freerdp, etc.). 3. For source builds: Download latest release from GitHub and rebuild.
🔧 Temporary Workarounds
Disable smartcard redirection
allAvoid using /smartcard or /smartcard-logon command-line options when connecting to untrusted RDP servers.
Do not add /smartcard or /smartcard-logon to xfreerdp command lines
Build without verbose assertions
linuxCompile FreeRDP with WITH_VERBOSE_WINPR_ASSERT=OFF to prevent abort() on assertion failure.
cmake -DWITH_VERBOSE_WINPR_ASSERT=OFF ...
make
make install
🧯 If You Can't Patch
- Disable smartcard redirection entirely when connecting to untrusted RDP servers
- Use alternative RDP clients for connections to untrusted servers
🔍 How to Verify
Check if Vulnerable:
Check FreeRDP version and if smartcard redirection is enabled in usage. Vulnerable if version < 3.23.0 and using /smartcard or /smartcard-logon.Check Version:
xfreerdp --versionVerify Fix Applied:
Verify FreeRDP version is 3.23.0 or later: xfreerdp --version should show 3.23.0+📡 Detection & Monitoring
Log Indicators:
- Client crash logs with abort() calls
- Assertion failure messages mentioning smartcard_unpack_read_size_align
Network Indicators:
- RDP connections with smartcard redirection enabled to suspicious servers
SIEM Query:
Process termination: xfreerdp OR freerdp AND exit_code abnormal AND command_line contains /smartcard