CVE-2026-110838 FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
Unauthenticated attackers can inject keyboard input into the host user's session by bypassing authentication checks in the FreeRDP shadow server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110838?
CVE-2026-110838 is a high-severity authentication bypass vulnerability in Freerdp Freerdp, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.
Weakness: CWE-306
Which versions are affected by CVE-2026-110838?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-110838?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-110838 being exploited?
There is no known exploitation of CVE-2026-110838 in the wild and no public exploit code.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-110838, GHSA-5xxg-89r9-vf9v, GHSA-m998-cvfm-9444, UBUNTU-CVE-2026-110838.