CVE-2026-109678

FreeRDP versions 3.0.0-beta1 before 3.32.0 are vulnerable to a reachable assertion when built with verbose WinPR assertions and smartcard emulation enabled. The root cause is that the emulated SCardStatusA function passes a NULL reader-name destination to scard_copy_strings. A malicious RDP serve...