Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-91945 →
DEBIAN-CVE-2026-91945
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields agai...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:14
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org