CVE-2026-109940

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0-beta1 through 3.31.0

Description Unix builds with PKCS#11 support contain a stack-based buffer overflow within the wprintKeyName() function of WinPR's NCrypt PKCS#11 provider. The issue occurs when the software hex-encodes a key's CKA ID (which can reach 64 bytes) into a fixed 128-byte stack buffer. An attacker can trigger a client crash during key enumeration by providing a malicious PKCS#11 token or module where the key and matching certificate utilize a CKA ID between 55 and 64 bytes.

Recommendations Update FreeRDP to version 3.32.0 or later.