CVE-2026-109678

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause a Denial of Service (DoS) by sending a specially crafted smartcard status request to a connecting client. When smartcard emulation is active and the client is built with verbose assertions enabled, processing this request triggers an assertion failure. This condition causes the client application to terminate unexpectedly, aborting the user session.

This flaw is rated Moderate upstream as a denial-of-service via a reachable assertion in emulated smartcard status handling. Red Hat Enterprise Linux and Fedora freerdp packages are built with WITH_VERBOSE_WINPR_ASSERT disabled, so the vulnerable assertion path is not present in shipped builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.