CVE-2026-109246
Received Received - Intake

Remote Code Execution in FreeRDP

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109246
EUVD
EUVD-2026-97690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.0 has a divide-by-zero vulnerability in its shadow server component. An authenticated client can send a maliciously crafted Frame Acknowledge PDU that causes the frame count to underflow. This leads to a division by zero error in shadow_encoder_create_frame_id(), resulting in a SIGFPE signal that terminates the process and disconnects all viewers.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP shadow server instances for crashes or disconnections triggered by malformed Frame Acknowledge PDUs. Check logs for SIGFPE errors or unexpected process terminations in FreeRDP shadow server processes.

Impact Analysis

If you use FreeRDP's shadow server feature, an attacker with authenticated access could exploit this flaw to crash the server, disconnecting all connected viewers. This could disrupt remote desktop sessions and potentially lead to denial-of-service conditions for users relying on the shadow server.

Compliance Impact

This vulnerability primarily impacts system availability by crashing the FreeRDP shadow server, which disconnects all viewer sessions. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is likely minimal unless availability is a critical requirement for those standards.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to address the divide-by-zero vulnerability. If upgrading is not immediately possible, restrict access to the FreeRDP shadow server to trusted users only to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart