CVE-2026-121955
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 04, 2026
Vendor
unknown
Description
FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to corrupt heap memory or crash clients using smartcard emulation.