Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

FreeRDP smartcard handling can cause crashes

CVE-2026-109676 · published 3 days ago
Summary

Versions of FreeRDP from the early 3.0 beta up to 3.31 can mishandle a smartcard connection, letting a bad request reuse memory that should have been released. This can lead to program crashes or corrupted data. Upgrade FreeRDP to version 3.32 or later to fix the issue.

What to do
  • Update debian freerdp3 to version 3.32.0+dfsg-1.
  • Update freerdp freerdp to version 3.32.0 or later.
Affected software
Ecosystem VendorProductAffected versions
– freerdp freerdp < 3.32.0
Debian:12 debian freerdp2 All versions
Debian:13 debian freerdp3 All versions
Debian:14 debian freerdp3 < 3.32.0+dfsg-1
Fix: upgrade to 3.32.0+dfsg-1
Original advisory text
FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-109676 · NVD
CVE-2026-109676 · MITRE
CVE-2026-109676 · OSV
GHSA-369h-7h2p-4685 · GHSA
DEBIAN-CVE-2026-109676 · OSV
Track software like this
Free during beta