CVE-2026-110838
7.5HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-306
Impact
Unauthenticated network attackers can inject arbitrary keyboard input directly into the host's active X11 user session. They only need network access to the FreeRDP shadow server's listening port.
Root cause
The FreeRDP shadow server processes and dispatches input PDUs via XTEST before client authentication completes during connection setup.
Affected systems
FreeRDP 3.0.0 before 3.32.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade to FreeRDP 3.32.0 or later. If patching immediately is not possible, stop the shadow server service or block its RDP port at the network firewall.
$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-shadow-x11AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.