{"id":"CVE-2026-121386","kind":"vulnerability","aliases":["CVE-2026-121386"],"related":[],"title":"FreeRDP: malformed PNG or JPEG clipboard data crashes the client","description":"FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.","summary":"FreeRDP's WinPR library does not handle libpng and libjpeg errors when decoding clipboard images. A malicious RDP server or man-in-the-middle can send a malformed PNG or truncated JPEG, making the client abort or exit.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","package","remote-desktop","windows","winpr"],"not_affected_if":["fixed-version","no-rdp-clients"],"how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it with the fixed release.\n- Look for FreeRDP builds or packages that bundle WinPR in your desktop or remote-access tooling.","fix":"- FreeRDP `3.32.2` or later.","status":"open","published_at":"2026-11-03T15:17:25+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","triaged_at":"2026-11-03T15:22:36+00:00","updated_at":"2026-11-03T15:22:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:22:36Z","model":"claude-haiku-5-5","output":{"fix":"- FreeRDP `3.32.2` or later.","reach":"network","title":"FreeRDP: malformed PNG or JPEG clipboard data crashes the client","impact":"low","summary":"FreeRDP's WinPR library does not handle libpng and libjpeg errors when decoding clipboard images. A malicious RDP server or man-in-the-middle can send a malformed PNG or truncated JPEG, making the client abort or exit.","audience":"developers","category":"package","nicknames":[],"who_cares":["freerdp","winpr","remote-desktop","linux","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Client crashes or exits during clipboard paste","analyst_note":"","how_to_check":"- Check the installed FreeRDP version, for example with `xfreerdp /version`, and compare it with the fixed release.\n- Look for FreeRDP builds or packages that bundle WinPR in your desktop or remote-access tooling.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-rdp-clients"],"who_is_affected":"Teams that run FreeRDP clients to connect to remote desktops, especially where users connect to servers they do not fully trust. The flaw is in the client's clipboard handling, so the server side is not the target. unknown whether other WinPR consumers are affected beyond the sources given.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4200,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121386':13A,16A '-2026':12A,15A '3.32.2':66C 'abort':61B,111C 'buffer':80C 'caus':107C 'client':10A,60B,109C 'clipboard':6A,38B,105C 'contain':67C 'convert':83C 'crash':8A 'cve':11A,14A 'data':7A 'decod':37B 'denial':69C 'desktop':22B 'error':35B,89C 'exit':63B,113C 'freerdp':1A,17B,25B,64C 'handl':31B,90C 'imag':39B 'jpeg':5A,57B,85C,104C 'lack':87C 'libjpeg':34B 'libpng':32B 'libpng/libjpeg':88C 'librari':28B 'linux':18B 'make':58B 'malform':2A,53B,100C 'malici':41B,92C 'man':46B 'man-in-the-middl':45B 'middl':49B 'mitm':96C 'offer':98C 'packag':19B 'payload':106C 'png':3A,54B,78C,101C 'rdp':42B,93C 'read':77C 'remot':21B 'remote-desktop':20B 'send':51B 'server':43B,94C 'servic':71C 'truncat':56B,103C 'vulner':72C 'window':23B 'winpr':24B,27B,74C,76C,82C","nicknames":[],"mitigations":[],"who_affected":"Teams that run FreeRDP clients to connect to remote desktops, especially where users connect to servers they do not fully trust. The flaw is in the client's clipboard handling, so the server side is not the target. unknown whether other WinPR consumers are affected beyond the sources given.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freerdp","high","linux","package","remotedesktop","windows","winpr"],"first_public_at":"2026-10-19T12:12:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121386","severity":null,"published_at":"2026-11-03T15:17:25+00:00","modified_at":"2026-11-03T15:17:25+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","fetched_at":"2026-11-03T15:21:56+00:00","note":null}],"documents":[{"id":58295,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:12:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58296,"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}