Live › vulnerability › CVE-2026-121397
FreeRDP before 3.32.2 has a heap buffer over-read in save_png_to_buffer() that a malicious RDP server can trigger by sending crafted 16 bpp DIB clipboard data. The leaked client heap bytes end up embedded in a PNG image visible to local applications.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams whose staff connect to remote desktops with FreeRDP-based clients, particularly to servers they do not fully trust. The flaw needs clipboard sharing with a hostile RDP server to be exploitable. Systems that do not run FreeRDP clients, or that do not share the clipboard with remote servers, are less exposed.
No product ranges from the sources yet.
xfreerdp --version, and confirm whether it is below 3.32.2.3.32.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.
This page as .md · .json · in your agent: get_signal("CVE-2026-121397")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.