CVE-2026-110838

{
  "etk_id": "ETK-2026-1616",
  "cve_id": "CVE-2026-110838",
  "display_id": "CVE-2026-110838",
  "ghsa_id": "GHSA-5xxg-89r9-vf9v",
  "euvd_id": "EUVD-2026-101721",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated keyboard input injection in FreeRDP shadow server",
  "summary": "FreeRDP shadow server versions 3.0.0 through 3.31.x process input before client authentication completes. An unauthenticated remote attacker can inject synthetic keystrokes into the host user's X11 session when the shadow server is reachable over RDP.",
  "mitigation": "Upgrade FreeRDP to version 3.32.0 or later. Until upgraded, restrict network access to the FreeRDP shadow server to trusted clients.",
  "vendor": "FreeRDP",
  "product": "FreeRDP",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, <= 3.31.1"
      ],
      "ecosystem": "c",
      "fixed_versions": [
        "3.32.0"
      ],
      "package_name": "FreeRDP",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1712,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.16702646666667,
  "t0_at": "2026-10-14T22:52:13.434000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T22:52:13.434000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T22:52:13.434000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110838"
    }
  }
}