| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | ≥ 3.3.0, < 3.32.0 | 3.32.0 |
FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrently on one card handle. A malicious RDP server can overlap these IRPs through separate context workers to free and reuse the SCardHandle, causing client-process heap corruption and termination.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free