Technical impact
FreeRDP versions before 3.29.0 contain a null pointer dereference flaw in the smartcard cache request decoders. The vulnerability is triggered when the client receives a smartcard cache request with a NULL lookup‑name pointer, causing the code to call strlen() on a null pointer and terminate the process. This results in a denial of service condition, allowing an attacker to crash the client application. The weakness corresponds to CWE‑476.
Affected Systems
The affected product is FreeRDP, all releases prior to version 3.29.0. The issue arises when smartcard emulation is enabled in the client configuration.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity for interruption of service. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits at the time of analysis. Based on the description, the attack requires an attacker able to send crafted smartcard cache requests to a running FreeRDP client—likely a remote or local threat depending on the deployment environment. The exact attack vector is not explicitly detailed in the advisory, so the pathway is inferred from the ability to transmit malformed requests to the client process.
