CVE-2026-109246

Analyzed Analyzed - Analysis Complete

Remote Code Execution in FreeRDP

Publication date: 2026-10-12

Last updated on: 2026-11-02

Assigner: VulnCheck

Description

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-11-02

Generated

2026-11-08

AI Q&A

2026-10-12

EPSS Evaluated

2026-11-07

NVD

CVE-2026-109246

EUVD

EUVD-2026-97690

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.32.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

FreeRDP before version 3.32.0 has a divide-by-zero vulnerability in its shadow server component. An authenticated client can send a maliciously crafted Frame Acknowledge PDU that causes the frame count to underflow. This leads to a division by zero error in shadow_encoder_create_frame_id(), resulting in a SIGFPE signal that terminates the process and disconnects all viewers.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP shadow server instances for crashes or disconnections triggered by malformed Frame Acknowledge PDUs. Check logs for SIGFPE errors or unexpected process terminations in FreeRDP shadow server processes.

Impact Analysis

If you use FreeRDP's shadow server feature, an attacker with authenticated access could exploit this flaw to crash the server, disconnecting all connected viewers. This could disrupt remote desktop sessions and potentially lead to denial-of-service conditions for users relying on the shadow server.

Compliance Impact

This vulnerability primarily impacts system availability by crashing the FreeRDP shadow server, which disconnects all viewer sessions. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is likely minimal unless availability is a critical requirement for those standards.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to address the divide-by-zero vulnerability. If upgrading is not immediately possible, restrict access to the FreeRDP shadow server to trusted users only to reduce exposure.

Hi! I’m here to help you understand CVE-2026-109246. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...