CVE-2026-67304

FreeRDP before 3.29.0 contains a null pointer dereference (CWE-476) in the cleanup path of smartcard device control requests: when decoding of reader-state data fails, the free_reader_states functions dereference a null pointer. A network attacker controlling the RDP peer — for example a malicious or compromised RDP server talking to a FreeRDP-based client, or a client attacking a FreeRDP-based server — can send malformed smartcard IRP requests with a non-zero reader count (cReaders) and truncated reader-state data to trigger the crash. The impact is denial of service only, consistent with the availability-only CVSS 4.0 score of 8.7 (VC:N/VI:N/VA:H), with no code execution or data exposure. Any deployment running FreeRDP prior to 3.29.0 that processes the smartcard redirection channel is affected, including standalone clients, embedded clients, and FreeRDP-based servers. No exploitation in the wild is reported (not in CISA KEV, EPSS 0.4%), but a public advisory/PoC exists (GHSA-78jj-45vh-jpm5), so patching should not be deferred.

What to do: Upgrade FreeRDP to 3.29.0 or later, and rebuild or redeploy downstream packages, embedded clients and servers that bundle the library. Until patched, avoid connecting FreeRDP-based clients to untrusted RDP servers with smartcard redirection enabled and restrict untrusted clients' access to FreeRDP-based servers. Inventory deployments by checking FreeRDP package/build versions against the 3.29.0 fix.