FreeRDP versions before 3.32.2 contain a use-after-free flaw in the Smartcard Emulation implementation. The bug occurs in the Emulate_SCardReleaseContext routine, which frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious RDP server can therefore send a sequence of smart card IRPs—ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, and then RELEASECONTEXT—to corrupt heap memory or crash the client application.

The vulnerability affects the FreeRDP client, specifically all releases earlier than 3.32.2. Users running those versions of the FreeRDP software are exposed to the described memory corruption risks.

The CVSS score of 8.7 indicates a high severity impact. Although the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the attack requires a malicious RDP server and the ability to communicate with a FreeRDP client. When the attacker can drive the client to execute the described sequence of smart card requests, the use-after-free can lead to arbitrary memory corruption and potentially remote code execution. Given the high CVSS and the remote attack surface, the risk to affected clients is substantial.