Linux Distros Unpatched Vulnerability : CVE-2026-109944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later...

CVE-2026-109944

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

CVE-2026-109948

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to an uninitialized memory disclosure within the smartcard_Transmit_Call function. A malicious RDP server can exploit this by sending SCardTransmit requests with an invalid card handle and a nonzero receive length. This causes smartcard_pack_tra...

CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcardTransmitCall that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing...

CVE-2026-109944

FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a Reachable Assertion (CWE-617) due to improper handle management. The software fails to remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context. Consequently, a subsequent call to Emulate_SCardTransmit may...

EUVD-2026-98709

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later looks up the deleted parent context and reaches a terminating WINPRASSERT. A malicious RDP server can crash a connecting client with...

PT-2026-111539

FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate SCardReleaseContext releases a smartcard-emulation context, so Emulate SCardTransmit later looks up the deleted parent context and reaches a terminating WINPR ASSERT. A malicious RDP server can crash a connecting client with...

PT-2026-111543

FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard Transmit Call that allows malicious RDP servers to read client memory. Servers can send SCardTransmit requests with an invalid card handle and nonzero receive length, causing smartcard pack...