FreeRDP: Use-after-free in smartcard handling
Summary
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in its smartcard handling. An attacker can trigger an invalid smartcard connect operation to reuse a freed smartcard handle object, which can lead to memory corruption or crashes. The CVSS 4.0 vector indicates that user interaction is required and that the impact on confidentiality, integrity and availability is high, but the sources conflict on the required privileges, so the exact preconditions should be verified. The NVD status was still Undergoing Analysis during research.
Affected
- FreeRDP from 3.0.0-beta1 before 3.32.0 (per GHSA and VulnCheck)
- Standard Windows mstsc is not affected by this CVE according to the research notes.
Fixed in
- FreeRDP 3.32.0 or later (patched version listed in the GHSA advisory)
Workaround
- No vendor workaround published.
- Unverified: disabling smartcard redirection where it is not needed may reduce exposure. The vendor has not confirmed this.
Exploitation
- No confirmed in-the-wild exploitation found.
- VulDB states that no exploit is available; these are VulDB's own assessments.
- CISA SSVC: Exploitation none, Automatable no.
- CISA KEV status was not verified.
Our recommendation
- Inventory all FreeRDP installations, including software that bundles FreeRDP.
- Update to FreeRDP 3.32.0 or later, or to the distribution build once it is available.
- Restrict smartcard redirection on systems where it is not required.
- Recheck NVD for final CVSS and vector data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-369h-7h2p-4685 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-109676 osv.dev
- FreeRDP 3.32.0 release github.com
- FreeRDP 3.32.0 release announcement www.freerdp.com
- VulDB entry vuldb.com
- Ubuntu security tracker ubuntu.com
- Vulners NVD record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:32.
Original description (NVD)
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.