FreeRDP CVE-2026-109676

Exploitation requires that smartcard redirection (the FreeRDP smartcard channel) be in use during the RDP session, and that the victim's FreeRDP client (3.0.0-beta1 through 3.31.x) connect to an attacker-controlled or compromised RDP server that issues an invalid smartcard connect operation. The limiting factors are significant: this is a client-side flaw needing passive user interaction (UI:P) - the user must initiate the outbound connection - and it only manifests when smartcard functionality is exercised, so deployments that never use smartcard redirection are not exposed. Authentication is not required of the attacker (PR:N), but the attacker must control the server endpoint the client reaches.

This is a genuinely serious client-side vulnerability but not an immediate drop-everything emergency absent confirmed exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) indicates a network-reachable, low-complexity flaw needing no attacker privileges but requiring passive user interaction (UI:P) - consistent with a FreeRDP *client* being attacked when its operator initiates a connection to a malicious or compromised RDP server. The use-after-free (CWE-416) yields high confidentiality, integrity, and availability impact with no scope change (SC:N/SI:N/SA:N), meaning impact is confined to the client process. Signals are missing rather than conflicting: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - the 8.7 reflects potential severity, not observed attacker interest. The practical gating factor is real: exploitation requires smartcard redirection to be in use and the victim to connect to attacker-controlled infrastructure, which narrows the realistic attack surface considerably below what the raw score suggests. Priority should be driven by whether smartcard redirection is actually used in the environment and by the ubiquity of FreeRDP as the underlying RDP client, rather than by assuming widespread opportunistic exploitation.

An attacker stands up or compromises an RDP server and lures a user running a vulnerable FreeRDP-based client (3.0.0-beta1 through 3.31.x) to connect to it. During the smartcard channel negotiation the server triggers an invalid smartcard connect operation, causing the client to reuse a freed smartcard handle object, corrupting memory and leading to a crash or potential code execution in the client process. No public exploit was identified at time of analysis, and the attack depends on the user initiating the connection (UI:P).