Key points
- FreeRDP shadow server versions before 3.32.0 are vulnerable to unauthenticated input injection.
- The issue allows attackers to send keyboard commands during the Confirm Active state.
- The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.7.
FreeRDP shadow server releases before version 3.32.0 contain an input injection vulnerability. Attackers can inject synthetic keystrokes into host user sessions without providing valid credentials.
What happened
The National Vulnerability Database records CVE-2026-110838 as affecting FreeRDP shadow server software. The flaw exists in versions 3.0.0 through those preceding 3.32.0. The vulnerability stems from how the server handles input Protocol Data Units during the Confirm Active state. This processing occurs before the system verifies user authentication. Consequently, unauthenticated attackers can dispatch these input units to the host.
According to the NVD description, attackers can negotiate a TLS-only Remote Desktop Protocol connection. They then send an input PDU without completing the Confirm Active handshake. This action injects synthetic keystrokes directly into the host user's X11 session. The mechanism utilises the XTEST extension to perform the injection. The weakness is classified under CWE-306.
Why it matters
The National Vulnerability Database assigns a CVSS score of 8.7 to this issue. This rating places the vulnerability in the high severity category. The ability to inject input before authentication is verified represents a significant security gap. Attackers do not need to compromise user credentials to execute commands.
The flaw allows remote actors to manipulate the host environment via the X11 session. This could lead to unauthorized command execution or data manipulation. The use of TLS-only RDP negotiation suggests the attack can occur over encrypted channels. This makes detection based on traffic inspection more difficult for security teams.
What happens next
- Identify all systems running FreeRDP shadow server versions prior to 3.32.0.
- Verify if any instances are exposed to untrusted networks or the internet.
- Monitor X11 session logs for unexpected keystroke patterns or commands.
- Prepare to upgrade to version 3.32.0 or later once available.
- Review network access controls to restrict RDP connections.
Patch priority
Security operations teams should prioritise updating systems that expose FreeRDP services to untrusted networks. Organisations typically begin by isolating affected shadow servers from direct internet access. Teams usually verify the current version against the vulnerable range before proceeding. It is advisable to test updates in a non-production environment first. Backing up configuration files ensures recovery if the update fails. Teams should monitor for any changes in session behaviour during the transition period.
What to do and how to stay safe: FreeRDP
- Audit inventory for FreeRDP shadow server installations below version 3.32.0.
- Restrict network access to RDP services using firewalls or security groups.
- Monitor authentication logs for failed login attempts followed by input activity.
- Plan for vendor updates once a patched version is confirmed available.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which FreeRDP versions are affected by CVE-2026-110838?
FreeRDP shadow server versions from 3.0.0 up to, but not including, 3.32.0 are affected.
What is the severity rating for this vulnerability?
The National Vulnerability Database rates it as high severity with a CVSS score of 8.7.
How do attackers exploit this flaw?
Attackers negotiate TLS-only RDP and send input PDUs before authentication to inject keystrokes.
