CVE-2026-109949— FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP 3.0.0 至 3.32.0 之前的版本中，其虚拟智能卡 GIDS（Global Interface Directory Service）实现存在对过多身份验证尝试的限制不当问题。该实现在每个句柄（handle）级别存储 PIN 重试计数器。恶意 RDP 服务器可以通过发送 VERIFY APDU 命令耗尽该计数器，然后请求新的 SCardConnect 连接以重置重试次数，从而对配置的智能卡 PIN 码实施无限制的在线暴力破解攻击。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109949
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109949
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109949
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109949 (2)
Same Patch Batch · FreeRDP · 2026-10-13 · 21 CVEs total
| CVE-2026-109676 | 8.8 HIGH | FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect |
| CVE-2026-109947 | 6.5 MEDIUM | FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read |
| CVE-2026-109677 | 6.5 MEDIUM | FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler |
| CVE-2026-109942 | 6.5 MEDIUM | FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet |
| CVE-2026-109941 | 6.5 MEDIUM | FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response |
| CVE-2026-109938 | 6.5 MEDIUM | FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update |
| CVE-2026-109946 | 6.5 MEDIUM | FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width |
| CVE-2026-109944 | 6.5 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle |
| CVE-2026-109939 | 6.5 MEDIUM | FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order |
| CVE-2026-109943 | 6.5 MEDIUM | FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order |
| CVE-2026-109678 | 6.5 MEDIUM | FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA |
| CVE-2026-109953 | 5.3 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin |
| CVE-2026-109952 | 5.3 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response |
| CVE-2026-109680 | 5.3 MEDIUM | FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username |
| CVE-2026-109679 | 5.3 MEDIUM | FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response |
| CVE-2026-109945 | 5.3 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmi |
| CVE-2026-109951 | 5.3 MEDIUM | FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name |
| CVE-2026-109940 | 4.3 MEDIUM | FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name |
| CVE-2026-109948 | 4.3 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection |
| CVE-2026-109950 | 4.3 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages |
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-111381
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Ca -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-111380
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple B -
CVE-2026-111379
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_ca -
CVE-2026-111378
FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustio
Same vendor: FreeRDP
-
CVE-2026-111381
FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Ca -
CVE-2026-111382
FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV -
CVE-2026-111380
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple B -
CVE-2026-111379
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_ca -
CVE-2026-111378
FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustio
Same weakness: CWE-307
-
CVE-2026-111675
Course-tencent-cloud through 2.0.1 Verification Code Brute F -
CVE-2026-111356
MacCMS v10 through 2026.1000.4056 Account Takeover via Passw -
CVE-2026-61611
Lychee: Missing rate limiting on album password unlock endpo -
CVE-2026-110861
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit B -
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated
V. Comments for CVE-2026-109949
No comments yet