CVE-2026-110838 — FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard…
Published: 2026-10-14 · CVSS: 8.7 · CVSS 4.0
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7