CVE-2026-109256: FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
alpine/freerdpto a version that resolves this vulnerability.Fixed in 3.32.2-r0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients in versions 3.10.0 through 3.32.2 are affected when they process clipboard content from an RDP peer. The vulnerable path involves conversion of a CF_DIB clipboard image to PNG.
What must an attacker do to trigger the vulnerability?
An attacker needs to act as, or control, an RDP clipboard peer and provide a large malicious CF_DIB image. Exploitation depends on causing a realloc failure during PNG conversion, after which an out-of-bounds memcpy can occur.
What is the expected impact?
The described outcome is a client crash, resulting in denial of service. The provided information does not establish confidentiality or integrity impact.