CVE-2026-67304

A null pointer dereference flaw in FreeRDP allows a remote attacker to cause a denial of service (DoS) via specially crafted smartcard requests. If reader-state decoding fails, the system attempts to free uninitialized states during cleanup, resulting in a process crash.

This Moderate-impact vulnerability causes a denial of service (DoS) in FreeRDP clients and proxies. If smartcard redirection is enabled, an attacker (via a malicious server or proxy client) can send specially crafted smartcard IRP requests to trigger a null pointer dereference during cleanup.

Note: FreeRDP packages shipped in Red Hat Enterprise Linux (RHEL) 9 and older are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable smartcard redirection in FreeRDP client configurations if smartcard functionality is not required. This can typically be achieved by launching the xfreerdp client without the /smartcard option, or by explicitly setting /smartcard:no if a configuration file is used. Disabling smartcard redirection will prevent the use of smartcard devices with FreeRDP sessions.