Divide-by-Zero Vulnerability in FreeRDP Shadow Server

CVE-2026-109246

What is CVE-2026-109246?

A divide-by-zero vulnerability exists in the FreeRDP shadow server prior to version 3.32.0. The issue arises when the frame ID in a client's Frame Acknowledge PDU is stored without proper range checks, leading to potential underflows in the in-flight frame count. An authenticated client can trigger this flaw by acknowledging a frame ID that is greater than the last sent frame, subsequently causing the shadow_encoder_create_frame_id() function to attempt a division by zero. This results in a process termination (SIGFPE) that disconnects all active viewers, potentially disrupting services reliant on the FreeRDP shadow server.

References