CVE-2026-109949
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 13, 2026
Vendor
unknown
Description
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.