Description
FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
Published: 2026-10-13
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service (client crash)
Action: Patch
AI Analysis

Impact

FreeRDP 3.0.0‑beta1 through versions before 3.32.0 contains a reachable assertion (CWE‑617) that is triggered when a client using smartcard emulation receives a specially crafted SCardStatusA request. The attacker sets the fmszReaderNamesIsNULL flag to 1, causing the client to pass a NULL reader‑name destination to scard_copy_strings. The embedded assertion fails and aborts the client process, producing a crash that renders the remote desktop session unavailable.

Affected Systems

All FreeRDP releases up to, but not including, version 3.32.0 are vulnerable. This encompasses the 3.0.0‑beta1 release and every subsequent 3.x build that still contains the verbose WinPR assertions and the legacy smartcard emulation code path. Users running any of these builds on Windows, Linux, or macOS risk a client crash if they connect to an attacker‑controlled RDP server.

Risk and Exploitability

The CVSS base score of 7.1 indicates a medium‑to‑high severity flaw. EPSS data is not currently available, and the vulnerability is not listed in CISA's KEV catalog. An attacker only needs to act as an RDP server and send a single SCardStatusA request; no authentication or local privileges are required. Exploitation is therefore feasible over the network, allowing an adversary to interrupt availability of the RDP session for the targeted user or organization.

Generated by OpenCVE AI on October 13, 2026 at 15:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or later, which removes the vulnerable assertion and corrects the smartcard emulation logic.
  • If an upgrade cannot be performed immediately, disable smartcard emulation in the client configuration to avoid executing the vulnerable code path.
  • Restrict inbound RDP traffic to known, trusted servers or block RDP connections from untrusted networks to reduce exposure to malicious smartcard requests.

Generated by OpenCVE AI on October 13, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an SCardStatusA request with fmszReaderNamesIsNULL=1 to abort a connecting client.
Title FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-617
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T13:57:50.627Z

Reserved: 2026-10-12T21:08:17.598Z

Link: CVE-2026-109678

cve-icon Vulnrichment

Updated: 2026-10-13T13:57:45.479Z

cve-icon NVD

Status : Received

Published: 2026-10-13T14:17:31.053

Modified: 2026-10-13T14:17:31.053

Link: CVE-2026-109678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T15:45:17Z

Weaknesses