FreeRDP CVE-2026-109949

Requires the FreeRDP client to be using smartcard redirection via the virtual smartcard GIDS implementation (the vulnerable per-handle PIN retry counter), and the victim must initiate an RDP session to an attacker-controlled or compromised server (UI:P). Exploitation is limited by: (1) smartcard redirection with virtual GIDS must be configured and in use - not a default for most FreeRDP deployments; (2) the victim must connect to the hostile server; (3) affected versions are FreeRDP 3.0.0 through 3.31.x (fixed in 3.32.0); (4) impact is confined to online brute-force recovery of the configured smartcard PIN, with no code execution or integrity/availability effect.

This is a moderate-priority confidentiality issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H) scoring 7.1 reflects a network-reachable, low-complexity flaw with no privilege requirement but passive user interaction (UI:P) - the victim must initiate an RDP connection to an attacker-controlled or compromised server. The threat model is inverted from typical RDP CVEs: here the malicious RDP SERVER attacks the connecting CLIENT, so PR:N describes the attacker-server side. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV; no public exploit code was referenced. The sole confirmed impact is confidentiality (VC:H) - recovery of the smartcard PIN via brute force - with no integrity or availability impact. Mitigating real-world risk heavily: exploitation requires the client to have smartcard redirection using the virtual smartcard GIDS feature actively configured, and requires luring the victim to a hostile server. Signals are internally consistent (network vector matches the RDP-over-network design; UI:P matches the required victim connection), so no contradiction needs vendor verification; the main missing signals are EPSS probability and any exploitation telemetry.

A victim configured to use FreeRDP smartcard redirection (virtual smartcard GIDS) connects to a malicious or compromised RDP server. The server repeatedly sends VERIFY APDUs to exhaust the per-handle PIN retry counter, then issues a new SCardConnect to reset the attempt count, looping this indefinitely to brute-force the smartcard PIN online. No public exploit code was identified at time of analysis, and exploitation requires the victim to initiate the connection (UI:P).