CVE-2026-109676

FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

Published Oct 13, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.

Analysis

Technical impact

FreeRDP versions 3.0.0‑beta1 through 3.31.x contain a use‑after‑free flaw in the smartcard connect routine. Triggering an invalid smartcard connection causes a freed handle object to be reused, allowing an attacker to manipulate or read memory associated with the freed object, potentially leading to memory corruption or application crashes.

Affected Systems

The vulnerability affects FreeRDP:FreeRDP, the open‑source Remote Desktop Protocol implementation. All releases from 3.0.0‑beta1 up to but not including 3.32.0 are impacted.

Risk and Exploitability

The CVSS score of 8.7 signals a high severity; the EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires the ability to cause an invalid smartcard connect operation, which could be performed remotely by an attacker who can connect to an RDP session that has smartcard support enabled. Successful exploitation can corrupt memory or crash the service, providing a foothold for further compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`3.0.0-beta1`	affected	< 3.32.0
`3.32.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[3.0.0-beta1,3.32.0)`	affected	semver	—
`3.32.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest FreeRDP patch or upgrade to version 3.32.0 or newer.
If an upgrade is not immediately possible, disable smartcard support in the FreeRDP configuration or restrict its use to trusted users only.
Monitor RDP sessions for unusual smartcard connection attempts and review logs for signs of memory corruption or crashes.

Generated by OpenCVE AI on October 13, 2026 at 15:35 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.264% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685
https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect

History

Oct 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 13, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
Title		FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-416
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-369h-7h2p-4685 https://www.vulncheck.com/advisories/freerdp-3.0.0-beta1-before-3.32.0-use-after-free-via-smartcard-connect
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`