CVE-2026-109945 in FreeRDP
Summary
by MITRE • 10/13/2026
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandle, causing client-process heap corruption and termination.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical security flaw within the smartcard emulation subsystem, specifically affecting how remote desktop protocol clients manage hardware abstraction layers for authentication tokens. This issue is classified as CWE-416, Use After Free, and aligns with MITRE ATT&CK technique T1557, Adversary-in-the-Middle, due to its potential exploitation in man-in-the-middle scenarios involving compromised or malicious remote servers. The core of the vulnerability lies in a race condition that occurs during concurrent operations on a single smartcard handle. Specifically, when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT commands are issued simultaneously against the same card context, the underlying memory management logic fails to properly synchronize access to the SCardHandle structure.
In normal operation, FreeRDP utilizes separate worker threads or contexts to process incoming remote desktop protocol requests asynchronously. When a malicious RDP server orchestrates these operations with precise timing, it can cause an interleaving of execution paths that bypasses standard locking mechanisms. The SCARD_IOCTL_DISCONNECT command initiates the release and deallocation of resources associated with the smartcard handle. However, if the SCARD_IOCTL_TRANSMIT command is processed concurrently before the memory has been fully reclaimed or reallocated safely by the operating system's heap manager, it attempts to access a pointer that no longer points to valid data. This results in the use of a dangling pointer, leading directly to heap corruption within the client process address space.
The operational impact of this vulnerability is severe, primarily resulting in denial-of-service conditions through application termination. When the heap corruption occurs, the FreeRDP client process typically crashes due to memory protection violations enforced by modern operating systems such as Windows or Linux with ASLR and DEP enabled. While immediate arbitrary code execution may be difficult to achieve reliably without additional exploitation primitives like information leaks, the instability introduced can disrupt secure remote access workflows that rely on smartcard-based multi-factor authentication. Furthermore, in environments where sensitive data is processed locally before being transmitted over the network, a crash could lead to incomplete transaction processing or exposure of unencrypted intermediate states if not handled by higher-level application logic.
Mitigation strategies focus primarily on version upgrades and configuration hardening. Organizations utilizing FreeRDP must upgrade to version 3.32.0 or later, where developers have implemented proper synchronization primitives such as mutexes or atomic operations to ensure that disconnect and transmit operations are serialized for a given card handle. Until an update is applied, administrators should restrict the use of smartcard emulation features in untrusted environments and consider network-level access controls to prevent connection from potentially malicious RDP servers. Additionally, enabling heap hardening options provided by the underlying operating system can help mitigate the consequences of memory corruption attempts by making exploitation more difficult, although this does not resolve the root cause of the race condition itself.