CVE-2026-109949 | BDVDB-2026-388674 Detail

Description#

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-13Record published in the CVE List.