Live › vulnerability › CVE-2026-114043
Go to dashboardFreeRDP's WinPR clipboard code mishandles low bit-depth PNG images when converting them to CF_DIB format, causing an out-of-bounds heap read. A malicious RDP server can send a crafted clipboard image that, when the victim pastes it, discloses megabytes of the client's heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running a FreeRDP client older than that connects to RDP servers, including clients built into other products that bundle FreeRDP. The exposure comes from the clipboard path when a remote server supplies the image, so clients used only against trusted internal servers carry lower risk. Servers and clients that never use the clipboard redirection feature are not reached by this flaw.
3.32.1No product ranges from the sources yet.
xfreerdp /version) and compare it with the fixed release.3.32.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-114043")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.