{"id":"CVE-2026-114046","kind":"vulnerability","aliases":["CVE-2026-114046"],"related":[],"title":"FreeRDP: null reader name in smartcard emulation crashes RDP client","description":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process.","summary":"FreeRDP 3.0.0 before 3.32.0 dereferences a null per-reader name in the smartcard emulation backend when handling SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry and crash the client process.","severity":"high","cvss":7.1,"epss":0.00254,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","rdp-clients","windows"],"not_affected_if":["fixed-version","smartcard-redirection-disabled"],"how_to_check":"- Run `xfreerdp /version` or check the installed FreeRDP package version and see whether it is below `3.32.0`\n- Check whether smartcard redirection (`/smartcard`) is enabled in the client configuration, since the flaw is in the smartcard emulation path","fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Until upgraded, disable smartcard redirection in RDP client sessions where it is not needed","status":"open","published_at":"2026-10-21T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:32:06+00:00","updated_at":"2026-10-25T03:32:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Until upgraded, disable smartcard redirection in RDP client sessions where it is not needed","reach":"network","title":"FreeRDP: null reader name in smartcard emulation crashes RDP client","impact":"low","summary":"FreeRDP 3.0.0 before 3.32.0 dereferences a null per-reader name in the smartcard emulation backend when handling SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry and crash the client process.","category":"package","nicknames":[],"who_cares":["freerdp","rdp-clients","linux","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"A malicious RDP server crashes the client process","analyst_note":"Confirm from the NVD entry whether smartcard redirection is on by default and whether the flaw is more than a crash; the sources only describe a null-pointer crash.","how_to_check":"- Run `xfreerdp /version` or check the installed FreeRDP package version and see whether it is below `3.32.0`\n- Check whether smartcard redirection (`/smartcard`) is enabled in the client configuration, since the flaw is in the smartcard emulation path","needs_analyst":true,"not_affected_if":["smartcard-redirection-disabled","fixed-version"],"who_is_affected":"Teams that run FreeRDP clients, or software that embeds FreeRDP, connecting to RDP servers they do not fully trust. The flaw sits in the smartcard emulation backend, so clients without smartcard redirection enabled are likely unaffected. The sources do not say whether the default configuration enables it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":3383,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114046':13A,16A '-2026':12A,15A '3.0.0':25B,62C '3.32.0':27B,64C 'accept':77C 'backend':39B,75C 'caus':103C 'client':10A,22B,59B,110C 'contain':65C 'craft':51B,94C 'crash':8A,57B,108C 'cve':11A,14A 'derefer':28B,70C 'emul':7A,38B,74C 'entri':55B,98C 'freerdp':1A,17B,24B,61C 'handl':41B 'linux':18B 'malici':45B,88C 'name':4A,34B,83C 'null':2A,30B,68C,79C,101C 'null-point':67C 'packag':19B 'per':32B,81C 'per-read':31B,80C 'pointer':69C 'process':60B,111C 'rdp':9A,21B,46B,89C 'rdp-client':20B 'reader':3A,33B,53B,82C,96C 'reader-st':52B,95C 'request':43B,86C 'scardgetstatuschang':42B,85C 'send':49B,92C 'server':47B,90C 'smartcard':6A,37B,73C 'state':54B,97C 'strcmp':104C 'szreader':102C 'wcscmp':106C 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that run FreeRDP clients, or software that embeds FreeRDP, connecting to RDP servers they do not fully trust. The flaw sits in the smartcard emulation backend, so clients without smartcard redirection enabled are likely unaffected. The sources do not say whether the default configuration enables it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114046","severity":null,"published_at":"2026-10-21T01:17:27+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114046","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114046","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}