UBUNTU-CVE-2026-121386: High severity ubuntu/freerdp vulnerability

Published Nov 3, 2026

Updated

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winprreadpngfrombuffer() and winprconvertfromjpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.

Affected Software

9 affected components

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp*

ubuntu/freerdp2*

ubuntu/freerdp3*

ubuntu/freerdp2*

ubuntu/freerdp3*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients are exposed when they connect to a malicious RDP server or when an attacker can perform a man-in-the-middle attack on the RDP connection. The affected Ubuntu package names listed are freerdp2, freerdp3, and freerdp.

What does an attacker need to do to trigger the denial of service?

The attacker must provide a malformed PNG clipboard payload or a truncated JPEG clipboard payload through the RDP connection. No authentication or user interaction is required according to the supplied vector.

What is the impact if exploitation succeeds?

The FreeRDP client can abort or exit, causing a denial of service for the active client session. The supplied impact vector indicates availability impact only, with no stated confidentiality or integrity impact.

UBUNTU-CVE-2026-121386: High severity ubuntu/freerdp vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the impact if exploitation succeeds?