FreeRDP releases prior to 3.29.0 feature a flaw in the smartcard device control request cleanup process. When reader-state decoding fails, the code attempts to free a reader‑state pointer that is null, causing a null pointer dereference. An attacker can trigger this by sending malformed smartcard IRP requests that include a non‑zero cReaders value and truncated reader-state data, which will crash the process handling the request. The crash results in an unresponsive RDP session or service interruption rather than code execution.

The vulnerability affects all FreeRDP installations that are version 3.28.x and earlier. Users of the open‑source FreeRDP building blocks or pre‑compiled binaries that have not been updated past the 3.29.0 release are susceptible.

The CVSS score of 8.7 places this flaw in the high‑severity range. Although the EPSS score is not available, the lack of a KEV listing does not reduce the attacker's ability to exploit it; any remote entity able to establish an RDP connection can craft the required IRP traffic. The likely attack vector is remote, over the RDP protocol, and does not require user interaction or privileged access on the target system. Successful exploitation results in a denial of service that can disrupt business continuity or lead to denial of remote desktop access.