CVE-2026-109246 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical denial-of-service condition within the freerdp-shadow-cli shadow server component. This flaw stems from an insufficient input validation mechanism regarding frame identification numbers during remote desktop session management. Specifically, when handling Frame Acknowledge Protocol Data Units sent by connected clients, the application fails to perform necessary range checks on the provided frame identifier. In a typical Remote Desktop Protocol interaction, frames are transmitted sequentially and acknowledged by the client to ensure reliable delivery. The server maintains an internal counter of in-flight frames using the shadow_encoder_inflight_frames function to track which frames have been sent but not yet confirmed as received.
The technical root cause lies in the logic governing frame ID validation within the shadow encoder module. When a client sends an acknowledgment for a specific frame, the system calculates the number of remaining unacknowledged frames by comparing the acknowledged identifier against the last transmitted one. Because the incoming frame ID is not validated to ensure it falls within the expected sequence range relative to previously sent data, an authenticated attacker can manipulate this value. By acknowledging a frame ID that exceeds the highest frame currently in flight or recently sent, the arithmetic operation intended to update the internal state results in an integer underflow. This mathematical error propagates directly into subsequent processing steps where the system attempts to derive new identifiers based on these corrupted counters.
The exploitation of this vulnerability allows any authenticated user connected to the shadow server to trigger a division-by-zero exception. In C-based applications like FreeRDP, such arithmetic errors typically result in a SIGFPE signal being sent to the process, causing immediate termination. Since the freerdp-shadow-cli service is responsible for managing active remote sessions and broadcasting video frames to multiple viewers simultaneously, its abrupt crash has severe operational consequences. The failure of this core component results in an instantaneous disconnection for all currently attached clients, effectively rendering the shared desktop session unavailable until the server process is manually restarted or recovered by system monitoring tools.
From a security classification perspective, this issue aligns with CWE-369, which describes divide-by-zero errors leading to application crashes, and falls under the broader category of CWE-20: Improper Input Validation. In terms of offensive security frameworks, specifically MITRE ATT&CK, this vulnerability facilitates Denial-of-Service (T1499) via endpoint or service disruption through exploitation of a software flaw. The requirement for authentication indicates that while remote unauthenticated attacks are not possible, insider threats or compromised credentials can be leveraged to disrupt critical infrastructure services relying on FreeRDP for virtual desktop access.
Mitigation strategies must prioritize immediate patching to version 3.32.0 or later, where the range check logic has been corrected to validate frame IDs against current transmission bounds before processing acknowledgments. Until patches are applied, administrators should enforce strict network segmentation and robust authentication policies to limit exposure of shadow server endpoints. Additionally, implementing process monitoring solutions that can automatically restart crashed services may help maintain availability during potential exploitation attempts, although this does not address the underlying code defect. Regular updates to remote desktop infrastructure components remain essential for maintaining resilience against such logic-based denial-of-service vectors.