FreeRDP versions 3.0.0 through 3.31.999 contain a heap use‑after‑free flaw in the smartcard emulation layer. When a remote desktop protocol server simultaneously issues SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT on the same card handle, the client can free and reuse the handle before all write operations complete. The overlapping input/response packets corrupt the client’s heap and cause termination, creating an opportunity for an attacker to execute arbitrary code on the local system.

The affected product is the FreeRDP client. All releases from 3.0.0 up to but not including 3.32.0 are vulnerable. Version 3.32.0 and later include the fix.

The CVSS score of 6.0 places this vulnerability in the medium severity range. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a trusted or compromised RDP server capable of sending smartcard commands; the attacker must be able to issue concurrent disconnect and transmit operations. If such conditions exist, an attacker could trigger heap corruption and gain code execution on the client system.