Advisory · CVE-2026-109676
Use-after-free in FreeRDP smartcard handling can corrupt client memory
FreeRDP 3.0.0-beta1 through the releases before 3.32.0 have a use-after-free flaw in smartcard handling that a remote attacker can use to corrupt memory or crash the client. The project rates it CVSS 3.1 8.8.
- Vendor
- FreeRDP
- Product
- FreeRDP
- Identifier / CWE
- CVE-2026-109676
CWE-416 - Action timing
- Immediate
Explain it like I’m five
The remote desktop client keeps using a smartcard object after freeing it, and a malicious server can arrange what that memory becomes.
- 01Connect to a hostile server
A user connects a FreeRDP client to an attacker-controlled RDP server.
- 02Smartcard path engaged
The server drives the client's smartcard handling into the use-after-free condition.
- 03Memory corrupted
The freed memory is reused under attacker influence, corrupting the client or worse.
What happened
The FreeRDP project disclosed CVE-2026-109676: a use-after-free weakness (CWE-416) in smartcard handling affecting releases from 3.0.0-beta1 before 3.32.0, reachable by a remote attacker through a malicious or compromised RDP server.
The project’s affected data marks 3.32.0 as the first unaffected release, so upgrading FreeRDP to 3.32.0 or later is the stated fix.
What to do
- Inventory every FreeRDP deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to FreeRDP while remediation is underway, especially for internet-facing instances.
- Review application and server logs for client crashes when connecting to new RDP servers and smartcard redirection enabled where it is not needed.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
RDP clients usually run on admin workstations, which makes a client-side memory flaw a credential-theft opportunity. Update the client and trim smartcard redirection.