THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67304 (HIGH 7.5) — FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process vi

[NVD] CVE-2026-67304 (HIGH 7.5) — FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process vi

mednvdPublished 2026-08-01

CVE-2026-67304 CVSS: 7.5 HIGH Published: 2026-08-01T13:16:59.970

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

Indicators of compromise

CVE-2026-67304cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67304