Vulnerability Details CVE-2026-109949
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 25.4%
CVSS Severity
CVSS v3 Score 6.5