CVE-2026-110838

Freerdp: missing authentication

Risk score: 59/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.3%
Published: 14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's …
Affected: Freerdp before 3.32.0
Fix: Upgrade Freerdp to 3.32.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freerdp: Amber, patch this week. FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWin…

The flaws

CVE-2026-110838: Missing authentication (CVSS 7.5 · EPSS 0%)
CVE-2026-111375: Out-of-bounds read can lead to denial of service (CVSS 9.1 · EPSS 0%)
CVE-2026-111382: Out-of-bounds write can lead to remote code execution (CVSS 8.8 · EPSS 0%)
CVE-2026-111380: Integer overflow (CVSS 8.8 · EPSS 0%)

The fix

Upgrade Freerdp: 3.32.0 or later on your release line

Who is exposed: Freerdp before 3.32.0

Where it stands

Public proof of concept

Connects to

Same weakness: Missing authentication (CWE-306). 283 other warnings in 30 days
Same product: Earlier Freerdp warnings. 29 in the last 90 days

Why it is Yellow

CVSS 7.5 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in

References

Original description

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Last activity 14 Oct 2026. Patch Forecast updates every hour.