High severity7.5NVD Advisory· Published Nov 4, 2026· Updated Nov 4, 2026
CVE-2026-121955
CVE-2026-121955
Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.