CVE-2026-109949: FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.0.0 through versions before 3.32.0 are affected when the virtual smartcard GIDS implementation is used. Exposure requires a client to connect to a malicious RDP server.
What does an attacker need to exploit the flaw?
An attacker needs to operate or control an RDP server that a FreeRDP client connects to and can send smartcard VERIFY APDUs. No prior privileges are required, but user interaction is required because the client must initiate the RDP connection.
Why does reconnecting to the smartcard matter?
The PIN retry counter is tracked per smartcard handle rather than persistently. After exhausting attempts through VERIFY APDUs, the malicious server can request a new SCardConnect handle and reset the counter, allowing unlimited online PIN guesses.
What version resolves the issue?
Upgrade FreeRDP to version 3.32.0 or later. The provided information identifies all versions before 3.32.0 as affected.