{"id":"CVE-2026-114043","kind":"vulnerability","aliases":["CVE-2026-114043"],"related":[],"title":"FreeRDP: malicious RDP server leaks heap memory via clipboard PNG","description":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.","summary":"FreeRDP's WinPR clipboard code mishandles low bit-depth PNG images when converting them to CF_DIB format, causing an out-of-bounds heap read. A malicious RDP server can send a crafted clipboard image that, when the victim pastes it, discloses megabytes of the client's heap memory.","severity":"high","cvss":7.1,"epss":0.00278,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","rdp-clients","windows"],"not_affected_if":["clipboard-redirection-disabled","trusted-servers-only"],"how_to_check":"- Check the installed FreeRDP version (for example `xfreerdp /version`) and compare it with the fixed release.\n- Confirm whether the client connects to servers you do not control.","fix":"- Upgrade FreeRDP to `3.32.1` or later.\n- Until upgraded, avoid connecting to untrusted RDP servers or pasting clipboard content from them.","status":"open","published_at":"2026-10-21T01:17:26+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:34:06+00:00","updated_at":"2026-10-25T03:34:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:34:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.1` or later.\n- Until upgraded, avoid connecting to untrusted RDP servers or pasting clipboard content from them.","reach":"network","title":"FreeRDP: malicious RDP server leaks heap memory via clipboard PNG","impact":"medium","summary":"FreeRDP's WinPR clipboard code mishandles low bit-depth PNG images when converting them to CF_DIB format, causing an out-of-bounds heap read. A malicious RDP server can send a crafted clipboard image that, when the victim pastes it, discloses megabytes of the client's heap memory.","category":"package","nicknames":[],"who_cares":["freerdp","rdp-clients","linux","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Heap memory from the client leaks to a malicious RDP server.","analyst_note":"","how_to_check":"- Check the installed FreeRDP version (for example `xfreerdp /version`) and compare it with the fixed release.\n- Confirm whether the client connects to servers you do not control.","needs_analyst":false,"not_affected_if":["trusted-servers-only","clipboard-redirection-disabled"],"who_is_affected":"Anyone running a FreeRDP client older than `3.32.1` that connects to RDP servers, including clients built into other products that bundle FreeRDP. The exposure comes from the clipboard path when a remote server supplies the image, so clients used only against trusted internal servers carry lower risk. Servers and clients that never use the clipboard redirection feature are not reached by this flaw.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":3457,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114043':13A,16A '-2026':12A,15A '3.32.1':77C '8':116C 'alloc':104C 'assum':124C 'base':82C 'bit':32B,107C,113C,139C 'bit-depth':31B 'bit-pack':106C 'bitmap':119C 'bound':48B,86C 'buffer':103C,109C,121C 'byte':126C 'caus':43B 'cf':40B,95C 'client':22B,71B 'clipboard':9A,27B,59B,91C,142C 'code':28B 'contain':78C 'convert':37B 'copi':122C 'craft':58B,136C 'cve':11A,14A 'depth':33B,114C,140C 'dib':41B,96C 'disclos':67B,150C 'format':42B 'freerdp':1A,17B,24B,75C 'heap':6A,49B,73B,81C,153C 'heap-bas':80C 'imag':35B,60B 'leak':5A 'linux':18B 'low':30B,138C 'low-bit-depth':137C 'malici':2A,52B,130C 'megabyt':68B,151C 'memori':7A,74B,154C 'mishandl':29B 'one':125C 'out-of-bound':45B,83C 'pack':108C 'packag':19B 'past':65B,146C 'payload':143C 'per':127C 'pixel':128C 'png':10A,34B,93C,101C,141C 'png-to-cf':92C 'pngs':111C 'rdp':3A,21B,53B,131C 'rdp-client':20B 'read':50B,87C,100C 'row':123C 'send':56B,134C 'server':4A,54B,132C 'synthesi':97C 'via':8A 'victim':64B,149C 'window':23B 'winpr':26B,89C,99C,118C 'write':120C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a FreeRDP client older than `3.32.1` that connects to RDP servers, including clients built into other products that bundle FreeRDP. The exposure comes from the clipboard path when a remote server supplies the image, so clients used only against trusted internal servers carry lower risk. Servers and clients that never use the clipboard redirection feature are not reached by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114043","severity":null,"published_at":"2026-10-21T01:17:26+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114043","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114043","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}