PT-2026-137007
CVE-2026-121955
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.
Found an issue in the description? Have something to add? Feel free to write us 👾