CVE-2026-111881: FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for CFDIB/CFDIBV5, crashing the client or causing an out-of-bounds write.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients running versions 3.14.1 through versions before 3.32.0 are exposed when they process clipboard image data from an RDP peer. The affected path handles CF_DIB and CF_DIBV5 clipboard formats.
What does an attacker need to exploit it?
An attacker needs to act as, or control, an RDP clipboard peer and provide a crafted 1-bpp BMP through the clipboard channel. No authentication privileges on the vulnerable client are indicated, but user interaction is required.
What can happen if exploitation succeeds?
The crafted image can trigger an integer underflow that passes SIZE_MAX - 3 to Stream_Zero. This can crash the FreeRDP client or lead to an out-of-bounds write.
What should teams do if they cannot immediately update?
The provided information identifies the clipboard image-processing path as the trigger but does not document a specific temporary mitigation. Prioritize avoiding connections to untrusted RDP peers that could supply crafted clipboard image data until an update is applied.