FreeRDP CVE-2026-109246

Requires that the target run the freerdp-shadow-cli shadow server (a non-default, uncommon FreeRDP deployment mode used for screen sharing), and that the attacker hold a valid authenticated client session (CVSS PR:L). The specific trigger is a Frame Acknowledge PDU whose frame id is exactly one greater than the last frame the server sent, which is stored without a range check and underflows the in-flight frame count in shadow_encoder_inflight_frames(), reaching the divide-by-zero in shadow_encoder_create_frame_id(). Exploitation is LIMITED by the need for valid authentication and by the fact that the vulnerable shadow server is rarely deployed in production; no user interaction is required (UI:N) and complexity is low once authenticated.

This is a moderate, availability-only denial-of-service issue, not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) correctly reflects the impact: network-reachable, low complexity, but requiring an authenticated session (PR:L) and causing only an availability impact (VA:H) with no confidentiality or integrity effect. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. The CVE is NOT in CISA KEV and no public exploit code was referenced, so there is no public exploit identified at time of analysis. SSVC inputs (exploitation status, automatable, technical impact) were not provided and cannot be assessed from the input. The signals are internally consistent - there is no CVSS-vs-description conflict - but the real-world impact is limited to crashing a running freerdp-shadow-cli process and disconnecting its viewers; it does not yield code execution or data exposure. Note the input Tags label this 'Information Disclosure,' which contradicts the vector's VC:N (no confidentiality impact) and the DoS-only description; treat the DoS characterization as authoritative. Overall this is a legitimate but lower-tier fix-when-convenient issue, materially constrained by the authentication requirement and the niche nature of the affected component.

An attacker who already holds valid credentials to a running freerdp-shadow-cli shadow server connects as a client and sends a Frame Acknowledge PDU referencing a frame id one greater than the last frame the server sent. The resulting in-flight frame count underflow drives a divide-by-zero (SIGFPE) that crashes the server and disconnects every connected viewer. No public exploit code was identified, and the attack requires an authenticated session and low complexity (CVSS AC:L/PR:L).