CVE-2026-109949

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0

Description An improper restriction of excessive authentication attempts exists in the virtual smartcard GIDS implementation. The system stores the PIN retry counter per-handle, allowing a malicious RDP server to exhaust the counter using VERIFY APDUs (Application Protocol Data Units, which are the communication units used in smart card protocols). The attacker can then request a new SCardConnect to reset the attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

Recommendations Update FreeRDP to version 3.32.0 or later.