{"id":"CVE-2026-121955","kind":"vulnerability","aliases":["CVE-2026-121955"],"related":[],"title":"FreeRDP: use-after-free lets a malicious server corrupt client memory","description":"FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.","summary":"FreeRDP's smartcard emulation frees a context before its worker thread is stopped, so memory is used after it is released. A malicious RDP server can send a crafted sequence of smartcard requests to corrupt heap memory or crash the client.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","rdp","remmina","smartcard"],"not_affected_if":["no-smartcard-emulation","trusted-servers-only"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp --version`, and compare it to the fixed release.\n- Check whether smartcard redirection or emulation is enabled in the client configuration; the sources do not name the exact setting.","fix":"- FreeRDP: move to `3.32.2` or later.","status":"open","published_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","triaged_at":"2026-11-04T16:28:42+00:00","updated_at":"2026-11-04T16:28:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T16:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP: move to `3.32.2` or later.","reach":"network","title":"FreeRDP: use-after-free lets a malicious server corrupt client memory","impact":"high","summary":"FreeRDP's smartcard emulation frees a context before its worker thread is stopped, so memory is used after it is released. A malicious RDP server can send a crafted sequence of smartcard requests to corrupt heap memory or crash the client.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freerdp","rdp","smartcard","linux","remmina"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Client memory corruption or crash, possibly code execution, triggered by a malicious server.","analyst_note":"Confirm whether smartcard emulation is default-on and check the vendor advisory on github.com for the exact affected builds.","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp --version`, and compare it to the fixed release.\n- Check whether smartcard redirection or emulation is enabled in the client configuration; the sources do not name the exact setting.","plain_action":"","needs_analyst":true,"not_affected_if":["no-smartcard-emulation","trusted-servers-only"],"who_is_affected":"Only RDP clients built from FreeRDP that use smartcard emulation are exposed, and the attacker must be the RDP server the client connects to. Clients that do not use smartcard emulation, or that connect only to trusted servers, are less exposed. The sources do not say whether smartcard emulation is on by default.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4227,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121955':15A,18A '-2026':14A,17A '3.32.2':68C 'cancel':89C 'client':11A,65B,113C 'contain':69C 'context':31B 'corrupt':10A,59B,108C 'craft':53B 'crash':63B,112C 'cve':13A,16A 'emul':28B,77C,82C,116C 'establishcontext':97C 'free':5A,29B,74C,80C 'freerdp':1A,19B,25B,66C 'getstatuschang':102C 'heap':60B,109C 'irp':106C 'join':91C 'let':6A 'linux':20B 'long':100C 'long-timeout':99C 'malici':8A,47B,93C 'memori':12A,39B,61B,110C 'packag':21B 'rdp':22B,48B 'releas':45B 'releasecontext':104C 'remmina':23B 'request':57B 'scardcontext':83C 'scardreleasecontext':78C 'send':51B,96C 'sequenc':54B 'server':9A,49B,94C 'smartcard':24B,27B,56B,105C,115C 'stop':37B 'thread':35B,87C 'timeout':101C 'use':3A,41B,72C,114C 'use-after-fre':2A,71C 'vulner':75C 'worker':34B,86C","nicknames":[],"mitigations":[],"who_affected":"Only RDP clients built from FreeRDP that use smartcard emulation are exposed, and the attacker must be the RDP server the client connects to. Clients that do not use smartcard emulation, or that connect only to trusted servers, are less exposed. The sources do not say whether smartcard emulation is on by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","package","rdp","remmina","smartcard"],"campaign_type":null,"first_public_at":"2026-10-20T17:19:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121955","severity":null,"published_at":"2026-11-04T16:17:48+00:00","modified_at":"2026-11-04T16:17:48+00:00","first_seen_at":"2026-11-04T16:28:11+00:00","fetched_at":"2026-11-04T16:28:11+00:00","note":null}],"documents":[{"id":68480,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-983v-jp34-f3fm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T17:19:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68481,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-in-smartcard-emulation-releasecontext","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}