CVE-2026-109944

6.5Medium

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-617

Impact

A malicious RDP server can crash your FreeRDP client process. To trigger it, an attacker needs a client with smartcard emulation and redirection enabled to connect to their rogue server.

Root cause

FreeRDP fails to clean up card handles when releasing a smartcard emulation context, causing subsequent transmit operations using the stale handle to trigger a fatal WINPR_ASSERT.

Affected systems

FreeRDP 3.0.0 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. If upgrading immediately is not possible, disable smartcard redirection/emulation in your client connection options.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109944