DEBIAN-CVE-2026-121397: Medium severity debian/freerdp2 vulnerability
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in savepngtobuffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CFDIB BIBITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using FreeRDP before 3.32.2 are exposed when they connect to a malicious RDP server. The affected Debian software entries are freerdp3 and freerdp2.
What must an attacker do to exploit it?
An attacker must operate or control a malicious RDP server and send 16 bpp CF_DIB clipboard data using BI_BITFIELDS. Exploitation occurs when that image is converted to PNG for a local application, potentially embedding client heap memory in the clipboard image.
What is the impact of successful exploitation?
The malicious server can cause disclosure of client heap memory through the generated clipboard image. The provided severity data indicates confidentiality impact only, with no indicated integrity or availability impact.