CVE-2026-121955: FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

Q: Which clients are exposed to this issue?

Clients running FreeRDP versions before 3.32.2 are affected when smartcard emulation is in use. The listed affected software includes Debian freerdp2 and freerdp3 packages.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to act as a malicious RDP server that a vulnerable client connects to. No client-side privileges or user interaction beyond establishing the connection are indicated by the supplied vector.

Q: Is smartcard emulation required for exploitation?

Yes. The vulnerable code path is in smartcard emulation and is triggered through smartcard IRPs, including ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, and RELEASECONTEXT.

Q: What is the likely impact on a vulnerable client?

A malicious server can corrupt heap memory or crash the client. The supplied CVSS vector indicates high availability impact, with no confidentiality or integrity impact specified.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2Patch GHSA-983v-jp34-f3fm

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which clients are exposed to this issue?

Clients running FreeRDP versions before 3.32.2 are affected when smartcard emulation is in use. The listed affected software includes Debian freerdp2 and freerdp3 packages.

What does an attacker need to exploit the vulnerability?

An attacker needs to act as a malicious RDP server that a vulnerable client connects to. No client-side privileges or user interaction beyond establishing the connection are indicated by the supplied vector.

Is smartcard emulation required for exploitation?

Yes. The vulnerable code path is in smartcard emulation and is triggered through smartcard IRPs, including ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, and RELEASECONTEXT.

What is the likely impact on a vulnerable client?

A malicious server can corrupt heap memory or crash the client. The supplied CVSS vector indicates high availability impact, with no confidentiality or integrity impact specified.

CVE-2026-121955: FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is smartcard emulation required for exploitation?

What is the likely impact on a vulnerable client?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Is smartcard emulation required for exploitation?

What is the likely impact on a vulnerable client?