CVE-2026-110838

Undergoing Analysis Undergoing Analysis - In Progress

Unauthenticated Keystroke Injection in FreeRDP Shadow Server

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110838

EUVD

EUVD-2026-101721

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects FreeRDP versions 3.0.0 to 3.32.0. The FreeRDP shadow server incorrectly processes input commands during the authentication phase, allowing attackers to send keyboard inputs without proper authentication. This can lead to unauthorized control of the host user's session.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for unauthenticated input PDUs during the Confirm Active state. Inspect FreeRDP installations for versions before 3.32.0. Network monitoring tools can detect suspicious input PDUs sent without proper authentication handshake.

Impact Analysis

Unauthenticated attackers could inject synthetic keystrokes into your X11 session via XTEST. This may allow them to execute unauthorized commands, manipulate applications, or gain control over your system remotely.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems, violating data integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be compromised due to potential data breaches or unauthorized modifications.

Mitigation Strategies

Update FreeRDP to version 3.32.0 or later to address the vulnerability. Disable the FreeRDP shadow server if not needed. Monitor network traffic for unauthorized RDP connections.

Hi! I’m here to help you understand CVE-2026-110838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70