Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-109676FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect

High 8.8

In plain English

A high-severity use-after-free in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability in smartcard handling that allows attackers to access a freed smartcard handle object after an invalid connect operation. Attackers can trigger an invalid smartcard connect operation to cause reuse of the freed handle, leading to memory corruption or crashes.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-devel2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-libs2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10freerdp-server2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr2:3.32.2-1.el10_2ALSA-2026:94514
AlmaLinux:10libwinpr-devel2:3.32.2-1.el10_2ALSA-2026:94514
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-109676
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-109676
Debian:14freerdp33.32.0+dfsg-1DEBIAN-CVE-2026-109676
Rocky Linux:10freerdp2:3.32.2-1.el10_2RLSA-2026:94514
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-109676
Ubuntu:24.04:LTSfreerdp33.32.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-109676
Ubuntu:26.04:LTSfreerdp33.32.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-109676

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 3.0.0-beta1 – before 3.32.0

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References