The vulnerability resides in FreeRDP's virtual smartcard GIDS implementation, where the PIN retry counter is stored per handle and can be reset by reestablishing a virtual smartcard connection. A malicious RDP server can send a series of VERIFY APDU commands to exhaust the counter, then reconnect to reset it, enabling unlimited online brute‑forcing of the smartcard PIN. This flaw allows an attacker to discover the PIN used for the virtual smartcard, potentially compromising the authentication of RDP sessions and exposing sensitive data.

FreeRDP version 3.0.0 through 3.31.999, inclusive of the 3.0.0 to 3.31.x branch, is affected. The vulnerability is present in any deployment using the virtual smartcard functionality. System administrators should review whether this feature is enabled and apply updates accordingly.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score is not available and the vulnerability is not listed in KEV. An exploit requires an attacker controlling the RDP server to issue repeated VERIFY APDU commands and reauthenticate to reset the counter. Because no privileged access on the client is needed, the risk remains significant, especially on systems where the virtual smartcard is enabled for authentication.