CVE-2026-114046: FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

Q: Which deployments are exposed?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when the smartcard emulation backend processes SCardGetStatusChange requests from an RDP server.

Q: What does an attacker need to do to trigger the crash?

An attacker needs to operate or control an RDP server that a user connects to. The server can send a crafted reader-state entry whose szReader value is null, causing the FreeRDP client process to crash.

Q: What is the impact of successful exploitation?

Successful exploitation causes a denial of service by crashing the FreeRDP client process. The provided information does not indicate confidentiality or integrity impact.

Published Oct 21, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client process.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when the smartcard emulation backend processes SCardGetStatusChange requests from an RDP server.

What does an attacker need to do to trigger the crash?

An attacker needs to operate or control an RDP server that a user connects to. The server can send a crafted reader-state entry whose szReader value is null, causing the FreeRDP client process to crash.

What is the impact of successful exploitation?

Successful exploitation causes a denial of service by crashing the FreeRDP client process. The provided information does not indicate confidentiality or integrity impact.

CVE-2026-114046: FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to do to trigger the crash?

What is the impact of successful exploitation?