CVE-2026-114046: 
Wolfi vulnerability analysis and mitigation

CVE-2026-114046 is a null-pointer dereference vulnerability in FreeRDP's smartcard emulation backend that allows a malicious RDP server to crash the FreeRDP client process. It affects FreeRDP versions 3.0.0 through 3.31.1, and was patched in version 3.32.0. The vulnerability was published on October 21, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is improper input validation (CWE-20) and a null-pointer dereference (CWE-476) in the smartcard emulation backend introduced with FreeRDP 3.0.0. When processing SCardGetStatusChangeA or SCardGetStatusChangeW device-control requests over the RDPDR channel, the decoder accepts a null NDR pointer for a reader-state entry's szReader field without validation, returning an entry where szReader == NULL. The emulation backend then passes this null pointer directly to strcmp (or _wcscmp in the wide-character variant) without a null check, causing a deterministic SIGSEGV crash. Exploitation requires the client to have smartcard emulation enabled (WITH_SMARTCARD_EMULATE=ON) and to connect to a malicious or compromised RDP server; no local privilege or race condition is needed. A proof-of-concept reproducer was included in the advisory, encoding and dispatching the crafted request through FreeRDP's production serializer (FreeRDP Advisory).

Successful exploitation results in a denial-of-service condition: the FreeRDP client process terminates with SIGSEGV (exit code 139), immediately severing the RDP session. The attack is repeatable — a malicious server can re-trigger the crash on every reconnection attempt, effectively preventing the client from maintaining any RDP session to that server. No confidentiality loss, integrity compromise, or code execution was demonstrated; the impact is limited to availability of the client process (FreeRDP Advisory, GitHub Advisory).

A source-only proof-of-concept reproducer was included in the FreeRDP security advisory (GHSA-q6pp-28g8-xqjc), demonstrating the crash through FreeRDP's production encoder and decoder without any wire-level manipulation. There is no evidence of in-the-wild exploitation or weaponized exploit kits at this time, and no threat actor attribution has been made. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction in the form of a client initiating a connection to a malicious server with smartcard emulation enabled (FreeRDP Advisory, GitHub Advisory).

1. Setup malicious RDP server: Deploy a malicious or compromised RDP server capable of injecting crafted RDPDR device-control messages. This can be achieved by attaching a custom RdpdrServerContext to a FreeRDP shadow server or equivalent RDP server implementation.
2. Lure victim client: Socially engineer or redirect a target user running FreeRDP (versions 3.0.0–3.31.1) with smartcard emulation enabled (FreeRDP_SmartcardEmulation=TRUE) to connect to the malicious server.
3. Establish RDP session: Allow the client to complete TLS/RDP negotiation, RDPDR channel setup, smartcard device announcement, and reach the RDPDR user-logged-on state.
4. Send crafted SCardGetStatusChange request: Transmit an SCardGetStatusChangeA (or SCardGetStatusChangeW) device-control request over the RDPDR channel with cReaders=1, an allocated reader-state array, and a null NDR pointer for the entry's szReader field.
5. Trigger null-pointer dereference: The FreeRDP client decoder accepts the null szReader and passes it to strcmp (or _wcscmp) in Emulate_SCardGetStatusChangeA/W without validation, causing a SIGSEGV and terminating the client process with exit code 139.
6. Repeat on reconnection: If the victim attempts to reconnect, the server can re-send the crafted request to persistently deny the client's ability to maintain an RDP session (FreeRDP Advisory).

• Process: FreeRDP client process (xfreerdp or equivalent) terminating unexpectedly with exit code 139 (SIGSEGV) or exit code 134 (SIGABRT under sanitizers) shortly after establishing an RDP session.
• Logs: Application crash logs or core dumps referencing a segmentation fault in strcmp, Emulate_SCardGetStatusChangeA, smartcard_GetStatusChangeA_Call, or smartcard_irp_device_control_call; AddressSanitizer output reporting SEGV on unknown address 0x000000000000 in the strcmp call chain.
• Network: RDPDR channel traffic containing SCardGetStatusChangeA/SCardGetStatusChangeW device-control requests (SCARD_IOCTL_GETSTATUSCHANGEA) with a null NDR pointer for the reader-state szReader field, particularly from unexpected or untrusted RDP server endpoints.
• Behavioral: Repeated FreeRDP client crashes immediately after session establishment when connecting to a specific RDP server, especially when smartcard emulation is enabled (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.0 or later, which contains the fix for this vulnerability (GitHub Advisory). The advisory recommends rejecting null per-reader name pointers in smartcard_unpack_reader_state_a and smartcard_unpack_reader_state_w, and adding null checks in Emulate_SCardGetStatusChangeA/W to return SCARD_E_INVALID_PARAMETER before calling strcmp or _wcscmp. As a workaround until patching is possible, disable smartcard emulation in FreeRDP client configurations and restrict RDP connections to trusted, verified servers only; implement network-level segmentation to limit exposure to potentially malicious RDP endpoints (FreeRDP Advisory, Red Hat Bugzilla).