CVE-2026-121955

A flaw was found in FreeRDP. A use-after-free vulnerability exists in the smartcard emulation feature where a smartcard context is released before its background worker thread is properly terminated. A malicious server can exploit this by sending a crafted sequence of smartcard I/O Request Packet...

PKCS11SSHAgent

SRO PKCS11 – SSH Agent CNG Sovereign unification PKCS11 + SSH-agent + Pageant + CNG/Smartcard A single Windows executable that unifies four traditionally separate functions: Full PKCS11 module Firefox, OpenSC, ssh -I SSH agent compatible with OpenSSH/Git/VS/WSL Pageant server compatible with...

CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

DEBIAN-CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955 FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955 FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955 FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

EUVD-2026-116955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955

FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free vulnerability within the Emulate_SCardReleaseContext function. The root cause is that the emulated SCardContext is freed before its associated worker thread is cancelled and joined. A malicious server can trigger this by sending ...

CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

RockyLinux 10 : freerdp (RLSA-2026:94514)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94514 advisory. freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling CVE-2026-109242 freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Fr...

PT-2026-137007

FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

UBUNTU-CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

CVE-2026-121955: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated…

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol RDP server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to...

Astra Linux – vulnerability in Chromium

Incomplete cleanup in the SmartCard component within Google Chrome prior to version 154.0.8037.57 allowed a remote attacker to exploit social engineering techniques to bypass system access restrictions by using a specially crafted HTML page. Chromium security severity: Medium...

omapi-cve-2015-6606-exploit

Simple Exploit for Verification of CVE-2015-6606 This is a simple exploit to verify a code injection vulnerability that exists in the SEEK smartcard service versions 3.1.0 and below CVE-2015-6606, Google internal bug ANDROID-22301786. The vulnerability allows specially crafted Android application...

CLEANSTART-2026-HX95442 Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader

Security vulnerability affects the qemu package. Integer overflow in the emulatedapdufromguest function in usb/dev-smartcard-reader...

CVE-2026-109676

A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol RDP server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to...