CVE-2026-114046

A flaw was found in FreeRDP. The smartcard emulation backend accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client process. This issue affects FreeRDP 3.0.0 before 3.32.0 when smartcard emulation is enabled.

This issue is rated Moderate because a user must connect the FreeRDP client to a malicious or compromised RDP server (UI:R), and the demonstrated impact is a client crash only (availability), with no confirmed confidentiality or integrity impact. Exploitation requires smartcard emulation to be enabled for the session. Red Hat Enterprise Linux 8 and 9 ship FreeRDP 2.x, which does not include this smartcard emulation code path and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not connect FreeRDP clients to untrusted RDP servers. If smartcard emulation is not required, disable it in the FreeRDP client configuration.