CVE-2026-110838CWE-306

CVE-2026-110838

High · published October 15, 2026

CVSS v3.1

7.5

EPSS

Percentile

18.6

In the wild

Unconfirmed

What it is

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00272 · 18.6th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-10-15T03:17Z

Affected products (1)

Product	Versions	Fixed in
freerdp/freerdp	≥ 3.0.0, < 3.32.0	3.32.0

References (2)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m998-cvfm-9444 · [email protected]https://www.vulncheck.com/advisories/freerdp-shadow-before-3.32.0-pre-authentication-input-injection-via-confirm-active-bypass · [email protected]

EPSS history

Timeline

16 OCT 03:27Z
EPSS moved — → 0%
epss
14 OCT 22:52Z
FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
cvelistv5
14 OCT 22:52Z
FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
cvelistv5