75 matches found
CVE-2026-121955
FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...
CVE-2026-121955 FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext
FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...
EUVD-2026-116955
FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...
CVE-2026-121955
FreeRDP versions prior to 3.32.2 are vulnerable to a use-after-free vulnerability within the Emulate_SCardReleaseContext function. The root cause is that the emulated SCardContext is freed before its associated worker thread is cancelled and joined. A malicious server can trigger this by sending ...
PT-2026-137007
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...
CVE-2026-121955: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated…
FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...
CVE-2026-109945
A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by crashing the connecting client application. When a user connects to a server with smartcard emulation enabled, the server can issue concurrent disconnect and transmit...
CVE-2026-109944
A flaw was found in FreeRDP. When smartcard emulation and redirection are enabled, a malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by crashing the connecting client. This issue occurs because FreeRDP fails to remove card handles when releasing a smartcard emulatio...
CVE-2026-109678
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a specially crafted smartcard status request to a connecting client. When smartcard emulation is active and the client is built with verbose assertions enabled, processing this...
SUSE CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
A flaw was found in FreeRDP. The smartcard emulation backend accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client process. This issue affects FreeRDP 3.0.0...
DEBIAN-CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
EUVD-2026-106997
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046
FreeRDP versions 3.0.0 before 3.32.0 are vulnerable to a null-pointer dereference within the smartcard emulation backend. The issue occurs when the backend accepts a null per-reader name during SCardGetStatusChange requests. A malicious RDP server can trigger this by sending a crafted reader-stat...
CVE-2026-114046
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...
CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client...