CVE-2026-110838

A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potentially performing unauthorized actions on the host system.

Red Hat has rated this vulnerability as Important because an unauthenticated remote attacker with network access to a running shadow server can bypass authentication checks and inject synthetic keystrokes directly into an active graphical session. This issue specifically affects environments using FreeRDP 3, which is included in Red Hat Enterprise Linux 10, whereas earlier enterprise versions utilizing FreeRDP 2 do not contain the vulnerable state-machine code. Overall exposure is limited on standard systems because the FreeRDP shadow daemon is not active by default and requires explicit execution by an administrator or user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not expose freerdp-shadow-cli to untrusted networks. Restrict access with host firewalling and require authentication.