HIGH 7.1 NVD
CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255
- https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-pin-brute-force-via-virtu
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.