CVE-2026-109246

6.5Medium

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-191

Impact

Authenticated clients can crash the freerdp-shadow-cli process and disconnect all active viewers by sending a crafted acknowledgment PDU. An attacker only needs valid login credentials to connect to the shadow server.

Root cause

The shadow server fails to validate the frame ID in incoming Frame Acknowledge PDUs, causing an integer underflow in the in-flight frame count that leads to a divide-by-zero crash.

Affected systems

FreeRDP versions before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or newer. If you cannot patch immediately, restrict network access to the shadow server or disable freerdp-shadow-cli until updated.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-shadow-cli

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109246