CVE-2026-91957: FreeRDP before 3.31.0 Use-After-Free via smartcard worker
FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions before 3.31.0 are affected when the smartcard RDPDR device handler is involved during channel setup. The issue is in the smartcard worker-thread path.
What must an attacker do to trigger the vulnerability?
An attacker must trigger worker-thread creation failure after the smartcard device has been registered during channel setup. This can leave the device manager holding a reference to a deallocated device pointer.
What is the potential impact?
Successful exploitation can cause a crash and may lead to code execution. The supplied severity vector rates availability impact as low and does not identify confidentiality or integrity impact.
How can this be remediated?
Upgrade FreeRDP to version 3.31.0 or later. The provided data does not specify a workaround for environments that cannot immediately upgrade.