FreeRDP versions before 3.29.0 are affected by a null pointer dereference vulnerability in the smartcard device control request cleanup process. The flaw is triggered when reader-state decoding fails during handling of smartcard IRP requests. Attackers can exploit this by sending malformed smartcard IRP requests containing non-zero cReaders values paired with truncated reader-state data. This causes a null pointer access in the free_reader_states functions, resulting in a process crash. The vulnerability enables remote denial-of-service attacks against systems using FreeRDP with smartcard redirection enabled. A fix has been issued in FreeRDP version 3.29.0. The vulnerability is tracked under CVE-2026-67304 and has been documented in a GitHub security advisory. Patch details are available via the referenced GitHub commit.