FreeRDP EUVD-2026-98700

Exploitation requires a specific build and runtime configuration of the FreeRDP CLIENT: it must be compiled with verbose WinPR assertions enabled AND must be using smartcard emulation - both are non-default/debug-oriented settings, so stock release builds are generally not affected. The victim must also actively initiate an RDP connection to an attacker-controlled or compromised server (UI:P / user interaction present), meaning this cannot be triggered against a client at rest. Limiting factors: the attacker must occupy the server role (reverse of normal RDP exploitation), the target must opt into smartcard emulation, and impact is confined to crashing the single connecting client - no lateral movement or code execution.

This is a client-side denial-of-service with limited real-world urgency, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) yields 7.1 by scoring full availability impact, but that score overstates practical risk for three reasons the vector alone obscures. First, the impact is purely availability (VC:N/VI:N) - a connecting FreeRDP client aborts via a reachable assertion (CWE-617); there is no code execution, data disclosure, or persistence, and only the single client process crashes. Second, the flaw is reachable ONLY in builds compiled with verbose WinPR assertions AND using smartcard emulation - neither is a standard production configuration - so AT:N (no attack requirements) understates a genuine target-side precondition that should arguably be AT:P. Third, the threat model is inverted from typical RDP CVEs: the MALICIOUS party is the server and the VICTIM is the connecting client (UI:P), so exploitation requires luring a user to connect to an attacker-controlled or compromised RDP endpoint. No EPSS score, KEV listing, or POC was provided; per input signals this is no public exploit identified at time of analysis. Net: a legitimate but low-severity client robustness bug, best patched on normal cadence rather than treated as an actively-exploited priority.

An attacker stands up or compromises an RDP server and entices a user running a vulnerable FreeRDP client (built with verbose WinPR assertions and smartcard emulation enabled) to connect to it. During session negotiation the malicious server returns an SCardStatusA response with fmszReaderNamesIsNULL=1, passing a NULL reader-name destination into scard_copy_strings and tripping a reachable assertion that aborts the client. No public exploit code was identified in the provided intelligence.