The vulnerability in FreeRDP is an out-of-bounds read in the smartcard_LocateCardsByATRA_Call function. The function fails to limit the ATR pattern byte count, allowing attackers to craft smartcard mask arrays that trigger interior memory reads. The read can leak heap data bit‑by‑bit, which attackers can use as a timing oracle to defeat address‑space layout randomisation and support subsequent remote code execution attempts.

The flaw affects the FreeRDP client releases from 2.0.0‑beta1 up to, but not including, 3.28.0. Any user or system running one of these versions and connecting to a remote desktop protocol server that enables smartcard redirection is potentially vulnerable.

The CVSS score of 7.1 indicates a high severity, while the lack of an EPSS entry and absence from the CISA KEV catalog suggest that widespread exploitation has not yet been reported. The attack requires a malicious RDP server that can send crafted ATR mask arrays to the client; thus the vector is remote over the network. Given the memory disclosure capability, attackers could undermine ASLR and craft a more targeted remote code execution attack.