Live › vulnerability › CVE-2026-121386
FreeRDP's WinPR library does not handle libpng and libjpeg errors when decoding clipboard images. A malicious RDP server or man-in-the-middle can send a malformed PNG or truncated JPEG, making the client abort or exit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams that run FreeRDP clients to connect to remote desktops, especially where users connect to servers they do not fully trust. The flaw is in the client's clipboard handling, so the server side is not the target. unknown whether other WinPR consumers are affected beyond the sources given.
No product ranges from the sources yet.
xfreerdp /version, and compare it with the fixed release.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.
This page as .md · .json · in your agent: get_signal("CVE-2026-121386")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.