CVE-2026-109948

A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol (RDP) server with smartcard redirection enabled, the server can issue a crafted smartcard transmission request with an invalid card handle. Because FreeRDP fails to properly clear or restrict the response buffer upon encountering this error, uninitialized client memory is serialized and returned to the server. This issue allows a malicious server to access sensitive client heap data, resulting in information disclosure.

This flaw is rated Moderate because a malicious RDP peer can disclose uninitialized client memory via smartcard SCardTransmit from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.