Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol used by organizations to enable remote access to systems. A use-after-free vulnerability in its smartcard channel handler allows attackers to trigger a process crash or potentially execute code when the worker thread creation fails during device setup. Exploitation requires smartcard redirection to be enabled and a local or adjacent network fault during connection setup.
Technical details
The vulnerability exists in the smartcard RDPDR device handler (channels/smartcard/client/smartcard_main.c). The DeviceServiceEntry() function registers a SMARTCARD_DEVICE with devman before creating its worker thread. If the CreateThread(CREATE_SUSPENDED) call fails after successful registration, the error path frees the device structure while devman retains a pointer to it. During normal channel teardown, devman_device_free() dereferences the stale DEVICE.Free callback, causing a use-after-free. The attack requires smartcard redirection to be active and a local trigger to force thread creation failure. The vulnerability affects FreeRDP versions before 3.31.0 and is fixed in version 3.31.0 and later.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory published
- 2026-09-15: patched: Fix released in FreeRDP 3.31.0
- 2026-09-15: advisory: CVE-2026-91957 published