CVE-2026-109949
Description
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can uncover a user's smartcard Personal Identification Number (PIN) through unrestricted brute-force authentication attempts. Because the virtual smartcard component resets the retry counter on each new connection handle rather than enforcing a persistent limit, an attacker can bypass attempt restrictions when a client connects with virtual smartcard authentication enabled. Successful exploitation allows the malicious server to recover the smartcard PIN and perform unauthorized cryptographic operations with the user's credentials.
Statement
This flaw is rated Moderate because a malicious RDP peer can disclose virtual smartcard PIN material through unrestricted authentication retries from the FreeRDP client process. The user must connect to the malicious server (UI:R). There is no direct integrity or availability impact from this issue alone. Memory hardening (ASLR/FORTIFY) does not eliminate the disclosure.
Mitigation
If smartcard redirection is not required, disable it on the FreeRDP client. Restrict connections to trusted RDP servers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
PIN brute-force via malicious server; UI:R C:H → Moderate.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
