FreeRDP CVE-2026-109945

Exploitation requires the FreeRDP client to use smartcard emulation/redirection and to connect to an attacker-controlled or compromised RDP server; the malicious server must then win a race by overlapping SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT IRPs across separate context workers on a single card handle to trigger the use-after-free. Limiting factors: the victim must actively initiate the session to the malicious server (UI:P), smartcard redirection must be enabled (not a universal default), and the attacker must reliably win a non-deterministic timing window (AT:P), making exploitation opportunistic and crash-only (availability) rather than a path to code execution.

This is a medium-severity, availability-only defect that should be triaged as moderate priority rather than an urgent emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P) scores 6.0 and maps impact solely to availability (VC:N/VI:N/VA:H) - the only consequence is client-process heap corruption and termination (a crash/DoS of the RDP client), not code execution, data theft, or integrity loss despite the 'Information Disclosure' tag in the input (which conflicts with the confidentiality-none rating and appears mislabeled). Two signals constrain real-world risk: AT:P (attack requirements present) reflects the race-condition timing window that must be won between concurrent DISCONNECT and TRANSMIT IRPs, and UI:P reflects that a victim must actively initiate an RDP session to an attacker-controlled server. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. CWE-362 (race condition) exploitation is inherently non-deterministic, further lowering reliable mass-exploitation potential. Net: a genuine but bounded issue - patch in normal cycles; it is not a drop-everything flaw given availability-only impact, required victim-initiated connection to a malicious server, and the timing-dependent trigger.

An attacker stands up or compromises an RDP server and lures a victim with smartcard redirection enabled to connect to it (e.g., via a malicious .rdp file or a spoofed/hijacked gateway). The malicious server issues overlapping SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT IRPs through separate context workers against one card handle, racing to free and then reuse the SCardHandle and corrupting the FreeRDP client's heap to crash it. No public exploit code was identified in the provided data, and the race window plus required user-initiated connection make reliable exploitation non-trivial.