PT-2026-137007

FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

PT-2026-111539

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate SCardReleaseContext releases a smartcard-emulation context, so Emulate SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR ASSERT. A malicious RDP server can crash a connecting client with...