CVE-2026-110838GHSA-m998-cvfm-9444

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

FreeRDP FreeRDP

CVSS

8.7High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.32.0Fixed versionCVE List

Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

3.32.0FreeRDPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard inpuTelegram: CVE Notify, 23 Oct 2026

Description

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Text from CVE List

Affected versions 2

FreeRDPaffected: 3.0.0 before 3.32.0CVE List
FreeRDPunaffected: 3.32.0CVE List