CVE-2026-114046: FreeRDP Use-After-Free Vulnerability

CVE-2026-114046 Overview

CVE-2026-114046 is a null pointer dereference vulnerability [CWE-476] in the FreeRDP smartcard emulation backend. The flaw affects FreeRDP versions 3.0.0 through 3.31.x and is resolved in 3.32.0. The vulnerable code accepts a null per-reader name in SCardGetStatusChange requests. A malicious Remote Desktop Protocol (RDP) server can send a crafted reader-state entry containing a null szReader value. When the FreeRDP client processes this entry, strcmp or _wcscmp is invoked on the null pointer and crashes the client process.

Critical Impact
A malicious or compromised RDP server can crash connecting FreeRDP clients, producing a denial-of-service condition against users who initiate smartcard-emulated sessions.

Affected Products

FreeRDP 3.0.0 through 3.31.x
FreeRDP client builds using the emulated smartcard backend
Downstream distributions and applications bundling vulnerable FreeRDP 3.x libraries

Discovery Timeline

2026-10-21 - CVE-2026-114046 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114046

Vulnerability Analysis

FreeRDP implements an emulated smartcard backend to support PC/SC-style operations over RDP virtual channels. The SCardGetStatusChange call allows a client to query the state of one or more smartcard readers. Each reader is represented by a state entry containing a reader name (szReader) and associated status fields. The vulnerable code path does not validate that szReader is non-null before passing it to string comparison routines. When the server-controlled entry omits the reader name, FreeRDP calls strcmp or _wcscmp with a null pointer, triggering a segmentation fault in the client process.

Root Cause

The root cause is missing input validation in the smartcard emulation backend. The backend trusts server-provided reader-state entries without verifying pointer validity before dereference. The classification matches [CWE-476] Null Pointer Dereference. Processing untrusted protocol data without sanitization inside a privileged client component extends the attack surface beyond expected RDP control messages.

Attack Vector

Exploitation requires a victim to connect their FreeRDP 3.x client to an attacker-controlled or compromised RDP server with smartcard redirection enabled. User interaction is required to initiate the session. Once connected, the server transmits a SCardGetStatusChange response or request containing a reader-state entry with szReader set to null. The FreeRDP client dereferences the null pointer during string comparison and crashes. The impact is limited to availability; the issue does not expose memory contents or allow code execution based on current analysis.

No verified public proof-of-concept code has been published. See the GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for upstream technical details.

Detection Methods for CVE-2026-114046

Indicators of Compromise

Unexpected FreeRDP client crashes or SIGSEGV signals shortly after establishing an outbound RDP session
Core dumps referencing strcmp or _wcscmp frames inside the FreeRDP smartcard channel code
Outbound RDP connections to untrusted or newly observed external hosts preceding client termination

Detection Strategies

Inventory endpoints and container images for FreeRDP shared libraries at versions 3.0.0 through 3.31.x using software composition analysis
Alert on repeated FreeRDP process crashes correlated with active RDP sessions and smartcard channel negotiation
Monitor outbound TCP 3389 (and configured RDP ports) to non-corporate destinations initiated by workstations with smartcard emulation enabled

Monitoring Recommendations

Collect endpoint process-exit telemetry and crash reports into a central analytics pipeline for correlation across hosts
Baseline normal RDP destinations per user and flag deviations, especially sessions terminating in client faults
Track package and container updates to confirm FreeRDP 3.32.0 or later is deployed enterprise-wide

How to Mitigate CVE-2026-114046

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later across all endpoints, build systems, and container images
Restrict outbound RDP connections to a known allow list of trusted internal and partner servers
Disable smartcard redirection on FreeRDP clients that do not require it until patching completes

Patch Information

The FreeRDP maintainers resolved CVE-2026-114046 in release 3.32.0. The fix adds null validation for the szReader field before string comparison in the emulated smartcard backend. Review the GitHub Security Advisory for commit references and backport guidance for downstream packagers.

Workarounds

Launch FreeRDP without the smartcard channel by omitting /smartcard and related emulation flags from client invocations
Enforce RDP egress filtering at the network perimeter to block connections to untrusted external servers
Educate users to connect only to vetted RDP endpoints and to report unexpected client crashes to the security team

bash

# Configuration example: launch FreeRDP without smartcard emulation
xfreerdp /v:trusted-rdp.internal.example /u:alice /cert:tofu
# Note: do NOT append /smartcard or /smartcard-logon until clients are upgraded to >= 3.32.0