CVE-2026-109676
FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 13, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 12, 2026
Description
FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-416 Use After Free
Affected Products
| Product | Versions |
|---|---|
FreeRDPFreeRDP |
|
References
- GitHub Security Advisory (GHSA-369h-7h2p-4685)vendor-advisory
- VulnCheck Advisory: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connectthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.