CVE-2026-109949 — FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counte…
Published: 2026-10-13 · CVSS: 7.1 · CVSS 4.0
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7