Live › vulnerability › CVE-2026-114046
Go to dashboardFreeRDP 3.0.0 before 3.32.0 dereferences a null per-reader name in the smartcard emulation backend when handling SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry and crash the client process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run FreeRDP clients, or software that embeds FreeRDP, connecting to RDP servers they do not fully trust. The flaw sits in the smartcard emulation backend, so clients without smartcard redirection enabled are likely unaffected. The sources do not say whether the default configuration enables it.
No product ranges from the sources yet.
xfreerdp /version or check the installed FreeRDP package version and see whether it is below 3.32.0/smartcard) is enabled in the client configuration, since the flaw is in the smartcard emulation path3.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.
This page as .md · .json · in your agent: get_signal("CVE-2026-114046")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.