FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its     virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP     server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts,     enabling unbounded online brute-forcing of the configured smartcard PIN. (CVE-2026-109949)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
371842	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	Local	high
365507	Linux Distros Unpatched Vulnerability : CVE-2026-109949	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-109949

high

Tenable Plugins

high

high