FreeRDP versions 3.0.0 through 3.31.x contain a flaw in the smartcard_Transmit_Call routine that allows an attacker to read uninitialized memory from the client. When a malicious RDP server sends an SCardTransmit request with an invalid card handle and a nonzero receive length, the library serializes up to 66,560 bytes of heap data that have never been written. This results in the disclosure of random client memory contents, which may contain sensitive information such as passwords, encryption keys, or configuration data.

The vulnerability affects the FreeRDP client suite, including all releases from version 3.0.0 up to, but not including, 3.32.0. Anyone running a FreeRDP client within this range and connecting to an RDP server that can send smartcard redirection traffic is potentially exposed.

The CVSS score of 5.3 indicates moderate severity; the vulnerability requires a remote RDP server with access to the client to issue crafted SCardTransmit messages. Because the attack vector is network‑based and the exploit does not require local privileges, the potential for widespread disclosure exists, especially in environments where smartcard redirection is enabled or where clients trust external RDP servers. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of exploit data does not reduce the need for mitigation.