Quick answers
- Is CVE-2026-114046 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114046 being exploited in the wild.
- How severe is CVE-2026-114046?
- Medium severity, with a CVSS score of 6.5, published 21 October 2026.
- Which products and versions are affected?
- FreeRDP Project FreeRDP 3.0.0 before 3.32.0.
- Is there a fix for CVE-2026-114046?
- Yes: fixed in 3.32.0. Until then: Disable smartcard emulation if not required, or restrict RDP connections to trusted servers only until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114046 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-114046?
- Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.32.0
Disable smartcard emulation if not required, or restrict RDP connections to trusted servers only until upgrading.
Technical details
A null-pointer dereference exists in the smartcard emulation backend when processing SCardGetStatusChange requests with a null per-reader name (szReader). The vulnerable code compares the remote reader name without null validation, calling strcmp or _wcscmp on a NULL pointer. The vulnerability requires smartcard emulation to be enabled and a network connection to the malicious RDP server; no authentication or user interaction is needed beyond initiating the connection.
Affected products
- FreeRDP Project FreeRDP 3.0.0 before 3.32.0
Timeline
- 2026-10-05: disclosed
- 2026-10-21: advisory