CVE-2026-109256: FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

Q: Which systems are exposed to this issue?

FreeRDP clients in versions 3.10.0 through 3.32.2 are affected when they process clipboard content from an RDP peer. The vulnerable path involves conversion of a CF_DIB clipboard image to PNG.

Q: What must an attacker do to trigger the vulnerability?

An attacker needs to act as, or control, an RDP clipboard peer and provide a large malicious CF_DIB image. Exploitation depends on causing a realloc failure during PNG conversion, after which an out-of-bounds memcpy can occur.

Q: What is the expected impact?

The described outcome is a client crash, resulting in denial of service. The provided information does not establish confidentiality or integrity impact.

Published Oct 12, 2026

Updated

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.

Affected Software

1 affected component

FreeRDP freerdp>=3.10.0<=3.32.2

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

FreeRDP clients in versions 3.10.0 through 3.32.2 are affected when they process clipboard content from an RDP peer. The vulnerable path involves conversion of a CF_DIB clipboard image to PNG.

What must an attacker do to trigger the vulnerability?

An attacker needs to act as, or control, an RDP clipboard peer and provide a large malicious CF_DIB image. Exploitation depends on causing a realloc failure during PNG conversion, after which an out-of-bounds memcpy can occur.

What is the expected impact?

The described outcome is a client crash, resulting in denial of service. The provided information does not establish confidentiality or integrity impact.

CVE-2026-109256: FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker do to trigger the vulnerability?

What is the expected impact?