CVE-2026-109676

Summary

FreeRDP contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation, potentially leading to memory corruption or crashes.

Exploitability

Exploitation is moderately difficult as it requires triggering an invalid smartcard connect operation to cause reuse of the freed handle, but the vulnerability is remotely triggerable with user interaction.

Blast radius

The vulnerability could impact any system running FreeRDP with smartcard authentication enabled, potentially leading to remote code execution or service disruption in environments where smartcard-based authentication is used.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FreeRDP 3.32.0 or later to remediate the use-after-free vulnerability in smartcard handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.