CVE-2026-91957

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). This use-after-free vulnerability exists in the smartcard RDPDR device handler. A remote attacker could exploit this by triggering a worker thread creation failure after device registration during channel setup. This leads to the deallocation of a device pointer while the device manager (devman) still retains a reference, which can result in a denial of service (crash) or potentially lead to arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the attack surface, disable smartcard redirection within FreeRDP client configurations if this functionality is not required. This action prevents the vulnerable smartcard RDPDR device handler from being utilized. Refer to FreeRDP documentation for specific instructions on disabling smartcard redirection.