Input Injection Vulnerability in FreeRDP Shadow Server by FreeRDP
CVE-2026-110838

8.7HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110838?

The FreeRDP Shadow Server, prior to version 3.32.0, is vulnerable to an input injection issue during the Confirm Active state. This flaw permits unauthenticated attackers to inject arbitrary keyboard input into the host user’s X11 session via the XTEST extension. The vulnerability allows attackers to negotiate a TLS-only RDP connection and send input PDUs without successfully completing the necessary Confirm Active handshake, leading to potential unauthorized access and malicious interactions within the user's environment.

Affected Version(s)

FreeRDP 3.0.0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-shadow-befor...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
skigeek16
opensec-intelligence
.