Live › vulnerability › CVE-2026-111881
Go to dashboardFreeRDP's WinPR BMP writer miscalculates buffer size for 1-bit-per-pixel images, causing an integer underflow. A malicious RDP server acting as clipboard peer can send a crafted image that crashes the client or writes out of bounds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of FreeRDP clients from up to but not including who connect to RDP servers they do not fully trust, with clipboard redirection active. Servers you control or fully trust are a lower risk. Systems on fixed versions can skip this.
3.14.13.32.0No product ranges from the sources yet.
xfreerdp --version or check the installed FreeRDP package version3.32.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.
This page as .md · .json · in your agent: get_signal("CVE-2026-111881")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.