GHSA-m998-cvfm-9444: FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

Q: Which deployments are exposed to this issue?

FreeRDP shadow server installations from version 3.0.0 up to, but not including, 3.32.0 are affected. The issue concerns shadow servers that can be reached by an attacker over RDP.

Q: What does an attacker need to exploit it?

An attacker does not need credentials or user interaction. They need network access to the shadow server and can negotiate a TLS-only RDP connection before sending an input PDU without completing Confirm Active.

Q: What is the practical impact of successful exploitation?

The attacker can inject synthetic keyboard input into the host user's X11 session through XTEST. The vulnerability affects integrity by allowing keystrokes to be dispatched before authentication.

Q: What is the remediation?

Upgrade the FreeRDP shadow server to version 3.32.0 or later. The affected range ends before 3.32.0.

Published Oct 14, 2026

Updated

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes into the host user's X11 session via XTEST.

Affected Software

1 affected component

FreeRDP FreeRDP shadow server>=3.0.0<3.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP shadow server to a version that resolves this vulnerability.
Fixed in 3.32.0

Event History

Oct 14, 2026

CVE Published

via OSV·10:52 PM

Data Sourced

via OSV·10:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP shadow server installations from version 3.0.0 up to, but not including, 3.32.0 are affected. The issue concerns shadow servers that can be reached by an attacker over RDP.

What does an attacker need to exploit it?

An attacker does not need credentials or user interaction. They need network access to the shadow server and can negotiate a TLS-only RDP connection before sending an input PDU without completing Confirm Active.

What is the practical impact of successful exploitation?

The attacker can inject synthetic keyboard input into the host user's X11 session through XTEST. The vulnerability affects integrity by allowing keystrokes to be dispatched before authentication.

What is the remediation?

Upgrade the FreeRDP shadow server to version 3.32.0 or later. The affected range ends before 3.32.0.

GHSA-m998-cvfm-9444: FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of successful exploitation?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of successful exploitation?

What is the remediation?