CVE-2026-109678: FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scardcopystrings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are FreeRDP versions from 3.0.0-beta1 before 3.32.0 that use smartcard emulation and were built with verbose WinPR assertions enabled. Clients that do not meet those conditions are not identified as affected by the provided information.
What does an attacker need to do to trigger the failure?
An attacker needs to operate or control a malicious RDP server that a FreeRDP client connects to. The server can send an SCardStatusA request with fmszReaderNamesIsNULL set to 1, causing the client to abort.
Is user interaction required?
Yes. A user must connect the affected FreeRDP client to the malicious RDP server. No attacker authentication or privileges are indicated as required.
What is the impact if exploitation succeeds?
The affected connecting client aborts, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.