FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow in the collect_keys() function, triggered during PKCS#11 key enumeration. When a smartcard token presents more than 64 public key objects, the function writes past the fixed 64‑entry array, allowing attacker‑chosen CKA_ID and CKA_LABEL data to corrupt heap memory. The overflow can cause arbitrary memory corruption on the heap, but no direct evidence of code execution is stated. This vulnerability corresponds to CWE-129 and CWE-787.

The affected product is FreeRDP, specifically the freerdp package. All installations running a version earlier than 3.32.0 are vulnerable. No specific sub‑components or modules are listed beyond the overall FreeRDP suite.

The vulnerability scores a CVSS impact of 7, indicating a high severity. The EPSS score is 0.00171 (<1%), so the exploitation probability is very low, and the issue is not listed in the CISA KEV catalog. Attackers need local access to the host and control over PKCS#11 smartcard tokens; the likely attack vector is local privilege escalation or local exploitation via a compromised legitimate user account. Given the need to enumerate more than 64 keys, practical exploitation may require a custom or specially configured smartcard.