CVE-2026-109944
Awaiting Analysis Awaiting Analysis - Queue

FreeRDP Smart Card Context Handling Flaw Leads to Client Crash

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-109944
EUVD
EUVD-2026-98709

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FreeRDP versions 3.0.0 through 3.31.0. When a smartcard-emulation context is released, the software fails to remove associated card handles. A malicious RDP server can exploit this by releasing a context, creating a new one, and sending a request with a stale card handle. This triggers a terminating assertion in the client, causing it to crash.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and smartcard emulation settings. Run 'xfreerdp --version' to verify if your FreeRDP version is between 3.0.0 and 3.31.1. If smartcard emulation and redirection are enabled, the system may be vulnerable. Check configuration files or command-line arguments for smartcard-related settings.

Impact Analysis

If you use FreeRDP with smartcard emulation and redirection enabled, a malicious RDP server could crash your FreeRDP client. This results in a denial of service for your client process, terminating it unexpectedly.

Compliance Impact

This vulnerability causes a denial of service by crashing the FreeRDP client process, which could disrupt access to remote systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could disrupt access to protected health information systems. However, the vulnerability does not directly lead to data breaches or unauthorized access, so primary compliance concerns relate to service availability rather than confidentiality or integrity.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable smartcard emulation and redirection if not required. If upgrading is not possible, restrict network access to FreeRDP clients or block untrusted RDP servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart