CVE-2026-109944: FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients from 3.0.0 before 3.32.0 are affected when smartcard emulation and smartcard redirection are enabled. The attack is delivered by a malicious RDP server to a connecting client.
What must an attacker do to trigger the crash?
The attacker must operate or control the RDP server that the client connects to. The server releases a smartcard-emulation context, creates another context, and then sends SCardTransmit using the stale card handle.
Is user interaction required?
Yes. A user must connect the FreeRDP client to the malicious RDP server; no attacker privileges on the client are indicated.
What is the impact of successful exploitation?
The client reaches a terminating WINPR_ASSERT and crashes, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.