CVE-2026-109246

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.0

Description The freerdp-shadow-cli shadow server fails to perform a range check on the frame id within a client's Frame Acknowledge PDU. This allows the in-flight frame count in the shadow encoder inflight frames() function to underflow. An authenticated client can trigger this by acknowledging a frame id that is one greater than the last frame sent, which leads to a divide-by-zero error (SIGFPE) in the shadow encoder create frame id() function. This results in the termination of the process and the disconnection of all viewers.

Recommendations Update to version 3.32.0 or later.