CVE-2026-110839: FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CFDIB bitmap data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.3.0 before 3.32.0 are affected only when built with WINPR_UTILS_IMAGE_JPEG=ON. The vulnerable path is used when clipboard redirection processes grayscale JPEG clipboard content.
What must an attacker do to trigger the flaw?
An attacker needs to operate or control a malicious RDP server that offers a grayscale JPEG through clipboard redirection. The client user must paste the offered item as CF_DIB bitmap data.
What is the likely impact on an affected client?
Processing the crafted clipboard data causes a heap-based out-of-bounds write because the output buffer is sized for one input component rather than three BGR components. This can corrupt client memory and crash the FreeRDP client.
What can be done if an upgrade is not immediately possible?
Avoid connecting affected clients to untrusted RDP servers and avoid pasting clipboard items offered by RDP servers as CF_DIB bitmap data. Deployments not built with WINPR_UTILS_IMAGE_JPEG=ON are not described as affected.