FreeRDP versions between 3.0.0 and 3.31.9 incorrectly retain card handles when a smart‑card emulation context is released. A malicious RDP server can then trigger a stale context lookup during a subsequent SCardTransmit call, causing the client to hit a WINPR_ASSERT and terminate. The result is a client‑side crash that does not provide remote code execution but interrupts the user session, effectively a denial‑of‑service attack. The weakness is exemplified by CWE‑617, a use‑after‑free flaw.

The vulnerability affects the FreeRDP project, specifically all releases from 3.0.0 up to and including 3.31.9. No other vendors or products are listed. If a system runs an older or earlier patched version, it could be vulnerable.

The CVSS score of 7.1 classifies the issue as high severity, yet the EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to operate a RDP server that the client trusts, initiate a connection, use the smart‑card emulation feature, release a context, and then send a SCardTransmit with a stale handle. The attack vector is confined to the RDP protocol; there is no opportunity for privilege escalation or remote code execution beyond the induced crash.