A missing bounds check in the smartcard data unpacking routine can cause a reachable assertion failure, which triggers an abort in the client. The result is a crash of the FreeRDP client application, effectively denying the user RDP access. Because the crash occurs in the client, there is no modification of the server or elevation of privileges, but it hampers usability for the affected session.

FreeRDP clients built with versions earlier than 3.23.0 that have smartcard redirection enabled are affected. The vulnerability is triggered only when the client connects to an RDP server that sends crafted smartcard data; it does not affect servers or clients that never enable smartcard support. All platforms that compile vanilla FreeRDP through the default build settings (which enable verbose WINPR assertions) are in scope, unless the build explicitly disables that assertion mechanism.

The CVSS score of 5 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is listed in no KEV catalog, further indicating that it is not widely exploited. An attacker must control a malicious RDP server and convince a user’s client to enable smartcard redirection, so the attack requires both a server compromise and a user interaction. Nevertheless, the client crash can be used for a local denial–of–service attack against the target machine or to disrupt connectivity in a managed environment.