This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-109949 →

DEBIAN-CVE-2026-109949

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which...

Original description

The description as published by the source.

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freerdp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org