Improper Authentication in FreeRDP's Virtual Smartcard Implementation

CVE-2026-109949

What is CVE-2026-109949?

The vulnerability in FreeRDP 3.0.0 prior to version 3.32.0 allows a malicious RDP server to exploit the improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation. This issue permits the abuse of the PIN retry counter, which is stored per-handle. By continuously sending VERIFY APDUs, an attacker can exhaust the allowed attempts and then issue a new SCardConnect request, resetting the retry counter. This vulnerability enables attackers to perform unbounded online brute-force attacks on the configured smartcard PIN, posing significant security risks to users relying on this implementation.

References