FreeRDP versions 3.0.0 through 3.31.x contain a null-pointer dereference in the smartcard emulation backend. The vulnerability is triggered when the client processes a smartcard reader state request containing a null reader name (szReader). The client calls strcmp or _wcscmp on the null pointer, causing a crash. The crash terminates the RDP client process, resulting in a denial‑of‑service for the affected user. This flaw is classified as CWE‑476: Null pointer dereference.

The affected product is the FreeRDP RDP client, versions older than 3.32.0. All releases beginning with 3.0.0 up to but not including 3.32.0 contain the vulnerable smartcard emulation code. The vulnerability can affect any system running one of these client versions over an RDP session.

The CVSS score is 7.1, indicating a moderate to high severity. The EPSS score is less than 1 %, suggesting a very low likelihood of exploitation at this time, and the flaw is not listed in the CISA KEV catalog. However, an attacker who can act as an RDP server can craft a reader‑state entry with a null szReader to trigger the crash. Because the exploit requires only a malicious RDP server, the attack is remote but privileged only to hosts that can establish RDP connections to the vulnerable client.