Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110838FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
High 7.5
In plain English
A high-severity missing authentication in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | freerdp | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| AlmaLinux:10 | freerdp-devel | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| AlmaLinux:10 | freerdp-libs | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| AlmaLinux:10 | freerdp-server | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| AlmaLinux:10 | libwinpr | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| AlmaLinux:10 | libwinpr-devel | 2:3.32.2-1.el10_2 | ALSA-2026:94514 |
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-110838 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-110838 |
| Debian:14 | freerdp3 | 3.32.0+dfsg-1 | DEBIAN-CVE-2026-110838 |
| Rocky Linux:10 | freerdp | 2:3.32.2-1.el10_2 | RLSA-2026:94514 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-110838 |
| Ubuntu:24.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-110838 |
| Ubuntu:26.04:LTS | freerdp3 | 3.32.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-110838 |
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N