FreeRDP CVE-2026-109944

Exploitation requires the FreeRDP client to be configured with BOTH smartcard EMULATION and smartcard REDIRECTION enabled, and the victim must actively initiate a connection to an attacker-controlled or compromised RDP server (UI:P). The server-side trigger is a specific sequence: call Emulate_SCardReleaseContext to release a smartcard-emulation context, establish another context, then issue Emulate_SCardTransmit with the stale card handle so the code dereferences the deleted parent context and reaches the WINPR_ASSERT. Limiting factors: smartcard emulation/redirection is a non-default feature set, the attack only yields a client crash (availability only, no code execution or data disclosure), and it depends on the victim connecting outward to a malicious server rather than any inbound reachability of the client.

This is a client-side denial-of-service (reachable assertion, CWE-617) in FreeRDP, scored CVSS 4.0 7.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H - network-reachable, low complexity, no privileges, but requiring passive user interaction, with impact limited to availability (VA:H) and no confidentiality or integrity effect. The direction of attack is inverted from the typical server-exploit model: a MALICIOUS RDP SERVER crashes a CONNECTING CLIENT, so the victim must initiate a connection to attacker-controlled infrastructure (consistent with UI:P). No CISA KEV listing and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; no EPSS score was supplied. Real-world priority is moderate and bounded: the impact is a crash, not code execution or data exposure, and triggering it requires the client to have smartcard emulation AND redirection enabled - a non-default feature set - which materially narrows the exposed population below what the raw AV:N/PR:N metrics suggest. EPSS and POC data are MISSING, so probabilistic exploitation likelihood cannot be confirmed; absence of KEV plus a DoS-only outcome argues against urgent prioritization for most deployments, while environments that routinely use smartcard redirection to untrusted gateways should patch promptly.

A user with smartcard emulation and redirection enabled connects their FreeRDP client to a malicious or compromised RDP server. The server releases a smartcard-emulation context, establishes a new one, then issues SCardTransmit referencing the stale card handle, causing FreeRDP to look up the deleted parent context and hit a terminating WINPR_ASSERT that crashes the client. No public proof-of-concept is identified in the available data, and exploitation requires the victim to actively initiate the connection (UI:P).