CVE-2026-109246GHSA-6vjv-4hm3-6698
FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU
FreeRDP FreeRDP
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.
Text from CVE List
Affected versions 2
- FreeRDPaffected: all versions before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List