FreeRDP Shadow Server CVE-2026-110838

Requires the target to be running the FreeRDP shadow server component (shadow/mirroring mode) from 3.0.0 up to but not including 3.32.0, with that server network-reachable by the attacker. The host must be driving an X11 session, since injection is delivered through XTEST - Wayland or non-X11 hosts are not directly affected by this path. Exploitation proceeds over a TLS-only RDP negotiation, and the attacker sends an input PDU during the Confirm Active state before authentication. No authentication, credentials, or user interaction are required (PR:N/UI:N). Limiting factors for defenders: the vulnerability is confined to the shadow-server feature rather than generic FreeRDP client/server use, an X11 session must be active for keystrokes to land, and hosts patched to 3.32.0 or later are not affected.

This is a genuine priority within its deployment niche rather than an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VI:H, score 8.7) is internally consistent with the description: a network-reachable, low-complexity, fully unauthenticated flaw (CWE-306, Missing Authentication for Critical Function) whose primary consequence is integrity (keystroke injection) with no direct confidentiality or availability impact - the VC:N/VA:N choices match a keyboard-injection bug. The PR:N/UI:N combination is the key risk driver: no credentials and no victim interaction are required, so any exposed shadow server is reachable. However, several corroborating signals are MISSING: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no POC/exploit-code indicator is present, so there is no public evidence of active or at-scale exploitation. The 'Authentication Bypass' tag aligns with CWE-306 and the description. The realistic ceiling of impact is higher than the VI:H label alone suggests, because injecting keystrokes into a logged-in X11 session can be leveraged to launch a terminal and run arbitrary commands as the host user - but that escalation is situational and not reflected in the base vector. Net: elevated and credible risk for anyone running the FreeRDP shadow server exposed to untrusted networks, but exploitation probability data is absent and cannot be confirmed from the provided input.

An attacker who can reach an exposed FreeRDP shadow server (3.0.0 up to but not including 3.32.0) negotiates a TLS-only RDP connection and, without authenticating or completing the Confirm Active handshake, sends an input PDU that the server dispatches prematurely. The injected synthetic keystrokes are delivered into the host user's live X11 session via XTEST, letting the attacker type commands as that user. No public exploit identified at time of analysis, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, local access, or user interaction are needed.