CVE-2026-110838

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110838
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110838.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110838
Aliases
  • GHSA-m998-cvfm-9444
Downstream
Published
2026-10-14T22:52:13Z
Modified
2026-10-15T10:47:32Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
Details

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110838.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
a34fa7c49d2a39aa49ace1d7bea9656912d8c7cb
Fixed
d27a4f7c1c63b62a5e60e5d939ad116cfb58ffc1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.32.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110838.json"