CVE-2026-109676: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
Published Oct 13, 2026
·Updated
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
Affected Software
1 affected component
FreeRDP freerdp>=3.0.0-beta1<3.32.0
Event History
Oct 13, 2026
CVE Published
via MITRE·01:27 PM
Data Sourced
via MITRE·01:27 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which FreeRDP versions are affected?
FreeRDP versions from 3.0.0-beta1 through versions before 3.32.0 are affected. Version 3.32.0 is outside the stated affected range.
2
Does exploitation require authentication or user involvement?
The supplied CVSS vector indicates that an attacker does not need privileges, but user interaction is required. The attack is network-reachable and has low attack complexity.