CVE-2026-109945: FreeRDP Use-After-Free Vulnerability

CVE-2026-109945 Overview

CVE-2026-109945 is a heap use-after-free vulnerability [CWE-362] in FreeRDP versions 3.0.0 through 3.31.x. The flaw resides in the smartcard emulation subsystem, where concurrent handling of SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operations on a single card handle creates a race condition. A malicious Remote Desktop Protocol (RDP) server can overlap these I/O Request Packets (IRPs) across separate context workers, freeing and reusing the SCardHandle structure. The result is client-side heap corruption and process termination. FreeRDP maintainers addressed the issue in version 3.32.0.

Critical Impact
A malicious RDP server can corrupt heap memory in the FreeRDP client, terminating the client process and disrupting remote desktop sessions.

Affected Products

FreeRDP 3.0.0 through 3.31.x
Applications embedding the vulnerable FreeRDP smartcard channel
Linux and Unix RDP clients built on FreeRDP 3.x

Discovery Timeline

2026-10-13 - CVE-2026-109945 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109945

Vulnerability Analysis

FreeRDP implements PC/SC smartcard redirection through virtual channel IRPs dispatched to worker threads. Each context worker processes smartcard operations referencing shared SCardHandle objects. The disconnect handler releases the handle and its backing memory while a parallel transmit worker continues to dereference the same pointer.

This race between SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT creates a use-after-free window. The transmit worker reads or writes freed memory, corrupting the client heap. The outcome is a crash of the FreeRDP process, breaking active sessions and interrupting user workflows.

Root Cause

The root cause is insufficient synchronization between smartcard IRP workers operating on the same card handle. The code frees the SCardHandle during disconnect without ensuring exclusive access, violating lifetime guarantees for in-flight transmit operations. [CWE-362] classifies this as a concurrent execution flaw using shared resources with improper synchronization.

Attack Vector

Exploitation requires the FreeRDP client to connect to an attacker-controlled RDP server with smartcard redirection enabled. The malicious server dispatches overlapping IRPs on a single card handle across separate context workers, timing the disconnect and transmit to collide. User interaction is required to initiate the connection. The vulnerability yields denial of service through client-process termination; the CVSS vector lists no confidentiality or integrity impact.

See the GitHub Security Advisory GHSA-8rpr-jjjg-5qv6 and the VulnCheck Advisory on FreeRDP for additional technical context.

Detection Methods for CVE-2026-109945

Indicators of Compromise

Unexpected FreeRDP client crashes shortly after establishing a session with smartcard redirection enabled.
Heap corruption signatures in core dumps referencing smartcard_* functions or SCardHandle structures.
Outbound RDP connections from workstations to untrusted or newly observed server IP addresses.

Detection Strategies

Inventory endpoints running FreeRDP 3.0.0 through 3.31.x using software asset management tooling.
Monitor for xfreerdp, wlfreerdp, or embedded FreeRDP processes exiting with SIGABRT or SIGSEGV.
Correlate RDP session establishment events with subsequent client process termination within short time windows.

Monitoring Recommendations

Enable AddressSanitizer or heap integrity checks in test environments to surface use-after-free conditions during QA.
Log outbound RDP (TCP/3389) destinations and alert on connections to servers outside approved allowlists.
Audit smartcard redirection configuration across managed FreeRDP deployments and disable where not required.

How to Mitigate CVE-2026-109945

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all affected clients.
Restrict outbound RDP connections to trusted servers using firewall allowlists.
Instruct users to avoid connecting to untrusted RDP endpoints, particularly when smartcard redirection is active.

Patch Information

The FreeRDP project released the fix in version 3.32.0. Details are documented in the GitHub Security Advisory GHSA-8rpr-jjjg-5qv6. Downstream Linux distributions should ship the patched package through standard channels; verify installed versions after updating.

Workarounds

Disable smartcard channel redirection by omitting /smartcard from the FreeRDP command line until patching is complete.
Limit RDP client usage to internally managed servers to reduce exposure to malicious server behavior.
Run FreeRDP within a sandbox or container to contain the impact of client-process crashes.

bash

# Verify installed FreeRDP version and launch without smartcard redirection
xfreerdp --version
xfreerdp /v:trusted-server.example.com /u:username