CVE-2026-109944
Received Received - Intake

FreeRDP Smart Card Context Handling Flaw Leads to Client Crash

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate_SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR_ASSERT. A malicious RDP server can crash a connecting client with smartcard emulation and redirection enabled by releasing a context, establishing another, and issuing SCardTransmit with the stale card handle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109944
EUVD
EUVD-2026-98709

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FreeRDP versions 3.0.0 through 3.31.0. When a smartcard-emulation context is released, the software fails to remove associated card handles. A malicious RDP server can exploit this by releasing a context, creating a new one, and sending a request with a stale card handle. This triggers a terminating assertion in the client, causing it to crash.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and smartcard emulation settings. Run 'xfreerdp --version' to verify if your FreeRDP version is between 3.0.0 and 3.31.1. If smartcard emulation and redirection are enabled, the system may be vulnerable. Check configuration files or command-line arguments for smartcard-related settings.

Impact Analysis

If you use FreeRDP with smartcard emulation and redirection enabled, a malicious RDP server could crash your FreeRDP client. This results in a denial of service for your client process, terminating it unexpectedly.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable smartcard emulation and redirection if not required. If upgrading is not possible, restrict network access to FreeRDP clients or block untrusted RDP servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart