CVE-2026-109945: FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandle, causing client-process heap corruption and termination.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.0.0 before 3.32.0 are affected when smartcard emulation is in use. Exploitation is initiated by a malicious RDP server interacting with the client.
What must an attacker do to trigger the flaw?
The attacker must cause SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT requests to overlap concurrently on the same smartcard handle through separate context workers. The attack requires user interaction, consistent with the supplied vector.
What is the practical impact?
Successful exploitation can corrupt the FreeRDP client process heap and terminate the client process. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.