FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge… (CVE-2026-109246)

The vulnerability (CVE-2026-109246) in FreeRDP before version 3.32.0 is a divide-by-zero error in the freerdp-shadow-cli shadow server component. Specifically, the frame id from a client's Frame Acknowledge PDU is accepted without range validation, which can cause the in-flight frame count to underflow in shadow_encoder_inflight_frames(). When an authenticated client acknowledges a frame id that is one greater than the last frame sent, shadow_encoder_create_frame_id() performs a division by zero, triggering a SIGFPE signal that terminates the process and disconnects all connected viewers.

This vulnerability results in a denial of service condition by crashing the freerdp-shadow-cli process, disconnecting all viewers connected to the shadow server. There is no impact on confidentiality or integrity reported. The attacker must be authenticated to exploit this flaw.

A fix is available in FreeRDP version 3.32.0 and later. Users should upgrade to version 3.32.0 or newer to remediate this vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes. Until patched, restrict access to authenticated clients and monitor for unusual frame acknowledgements if possible.