CVE-2026-121397: FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()

Q: Which clients are exposed to a malicious server?

FreeRDP versions before 3.32.2 are exposed when they connect to a malicious RDP server that sends specially crafted 16 bpp DIB clipboard data.

Q: What must occur for client memory to be leaked?

The attacker must provide a CF_DIB image using BI_BITFIELDS, and the image must be converted to PNG for a local application. The resulting clipboard image can contain leaked client heap bytes.

Q: Does exploitation require prior authentication or other client privileges?

No privileges are required according to the supplied vector, but user interaction is required. The attack is network-reachable through an RDP connection to the malicious server.

Q: What version remediates the issue?

Upgrade FreeRDP to version 3.32.2 or later. The affected range is versions before 3.32.2.

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in savepngtobuffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CFDIB BIBITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.

Affected Software

1 affected component

FreeRDP freerdp<3.32.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which clients are exposed to a malicious server?

FreeRDP versions before 3.32.2 are exposed when they connect to a malicious RDP server that sends specially crafted 16 bpp DIB clipboard data.

What must occur for client memory to be leaked?

The attacker must provide a CF_DIB image using BI_BITFIELDS, and the image must be converted to PNG for a local application. The resulting clipboard image can contain leaked client heap bytes.

Does exploitation require prior authentication or other client privileges?

No privileges are required according to the supplied vector, but user interaction is required. The attack is network-reachable through an RDP connection to the malicious server.

What version remediates the issue?

Upgrade FreeRDP to version 3.32.2 or later. The affected range is versions before 3.32.2.

CVE-2026-121397: FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()

Affected Software

Remediation

Event History

Frequently Asked Questions

Which clients are exposed to a malicious server?

What must occur for client memory to be leaked?

Does exploitation require prior authentication or other client privileges?

What version remediates the issue?

Company

Resources

Contact

Frequently Asked Questions

Which clients are exposed to a malicious server?

What must occur for client memory to be leaked?

Does exploitation require prior authentication or other client privileges?

What version remediates the issue?