CVE-2026-109949

MEDIUM 6.5

FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

CWE	CWE-307
Vendor	freerdp
Product	freerdp
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

FreeRDP / FreeRDP

3.0.0 < 3.32.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255 vulncheck.com: https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-pin-brute-force-via-virtual-smartcard

Credits

Kushalkhemka opensec-intelligence mayank-jangid-moon skigeek16