CVE-2026-121955 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP's smartcard emulation frees a context before its worker thread is stopped, so memory is used after it is released. A malicious RDP server can send a crafted sequence of smartcard requests to corrupt heap memory or crash the client.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only RDP clients built from FreeRDP that use smartcard emulation are exposed, and the attacker must be the RDP server the client connects to. Clients that do not use smartcard emulation, or that connect only to trusted servers, are less exposed. The sources do not say whether smartcard emulation is on by default.
Not affected if no-smartcard-emulation, trusted-servers-only
Who cares freerdp, linux, rdp, remmina, smartcard
xfreerdp --version, and compare it to the fixed release.3.32.2 or later.FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.
This page as .md · .json · in your agent: get_signal("CVE-2026-121955") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.