Is CVE-2026-110838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110838 being exploited in the wild.

How severe is CVE-2026-110838?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP 3.0.0 through 3.31.1.

Is there a fix for CVE-2026-110838?

Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110838 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110838?

Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110838: FreeRDP shadow input injection before authentication

CVE-2026-110838 · Severity: high · CVSS 7.5 · Published 2026-10-14

FreeRDP shadow is a remote desktop protocol server component that allows users to share their display. An unauthenticated attacker can inject keyboard input into the host user's session by bypassing authentication checks, potentially typing commands or actions on the victim's system.

Technologies: FreeRDP Project FreeRDP. Vendors: FreeRDP Project.

Quick answers

Is CVE-2026-110838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110838 being exploited in the wild.
How severe is CVE-2026-110838?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP 3.0.0 through 3.31.1.
Is there a fix for CVE-2026-110838?: Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110838 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110838?: Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.0

Technical details

The vulnerability exists in libfreerdp/core/peer.c where input PDUs are processed during the CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE state without verifying authentication status. An attacker can negotiate TLS, complete initial protocol handshake, and send an input PDU without sending Confirm Active, causing the server to dispatch keyboard events via XTEST to the X11 display before the PostConnect authentication callback executes. The attack requires network access to the shadow listener and the default interaction setting enabled.

Affected products

FreeRDP Project FreeRDP 3.0.0 through 3.31.1

Timeline

2026-09-30: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.