CVE-2026-109949

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can uncover a user's smartcard Personal Identification Number (PIN) through unrestricted brute-force authentication attempts. Because the virtual smartcard component resets the retry counter on each new connection handle rather than enforcing a persistent limit, an attacker can bypass attempt restrictions when a client connects with virtual smartcard authentication enabled. Successful exploitation allows the malicious server to recover the smartcard PIN and perform unauthorized cryptographic operations with the user's credentials.

This flaw is rated Moderate because a malicious RDP peer can disclose virtual smartcard PIN material through unrestricted authentication retries from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.