CVE-2026-121955 in FreeRDP
Summary
by MITRE • 11/04/2026
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical use-after-free condition within the smart card emulation subsystem, specifically affecting the Emulate_SCardReleaseContext function. This flaw arises from an improper synchronization mechanism between the main application thread and background worker threads responsible for handling smart card context operations. When a client initiates a release of a smart card context via the RELEASECONTEXT instruction, the system attempts to free the associated SCardContext structure. However, if there is an active GETSTATUSCHANGE operation pending with a long timeout value, the corresponding worker thread remains alive and retains references to that same memory block. The failure to properly cancel and join this worker thread before deallocating the context leads directly to a race condition where freed memory may still be accessed or modified by the lingering thread.
From an operational perspective, this vulnerability allows for significant disruption of service and potential code execution on affected systems. A malicious remote server can exploit this flaw by orchestrating a specific sequence of Inter-Process Communication (IPC) requests: first establishing a context via ESTABLISHCONTEXT, then initiating a GETSTATUSCHANGE command with an extended timeout to keep the worker thread active, and finally sending RELEASECONTEXT to trigger the premature deallocation. The resulting heap corruption or application crash can lead to denial-of-service conditions for users relying on smart card authentication through FreeRDP sessions. In more severe scenarios involving sophisticated exploitation techniques, such memory corruption vulnerabilities may be leveraged to achieve arbitrary code execution by manipulating heap metadata or overwriting function pointers within the corrupted data structures.
This issue aligns with Common Weakness Enumeration (CWE) category CWE-416, which describes Use After Free errors where a pointer is used after it has been freed, leading to undefined behavior and potential security breaches. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Initial Access and Execution through remote services, specifically leveraging weaknesses in resource management within network-facing applications. The exploitation vector requires interaction with a smart card emulation service over RDP, placing it under tactics that involve exploiting trusted software components to gain footholds or disrupt operations.
Mitigation strategies primarily focus on updating the FreeRDP installation to version 3.32.2 or later, where this synchronization issue has been resolved by ensuring proper thread lifecycle management before memory deallocation. Administrators should verify that all smart card redirection features are updated and monitor for any anomalous behavior in RDP sessions involving external smart card readers. Additionally, implementing network-level authentication restrictions can reduce the attack surface by limiting which clients or servers can interact with these emulation services, thereby providing a layer of defense-in-depth against potential exploitation attempts targeting this specific race condition.