CVE-2026-109949CWE-307

CVE-2026-109949

Medium · published October 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00346 · 27.0th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-10-13T18:17Z
Affected products (1)
ProductVersionsFixed in
freerdp/freerdp≥ 3.0.0, < 3.32.03.32.0
References (2)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-chh2-527f-x255 · [email protected]https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-pin-brute-force-via-virtual-smartcard · [email protected]
EPSS history
Timeline
  • 15 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 13 OCT 13:27Z
    FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
    cvelistv5
  • 13 OCT 13:27Z
    FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
    cvelistv5