Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-110838

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 3.0.0 to < 3.32.0affected
  • 3.32.0unaffected

References