Out-of-bounds read in FreeRDP clipboard PNG handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read (CWE-125) in WinPR's clipboard PNG conversion. The PNG reader allocates a bit-packed buffer for bit depths below 8, but the copy step assumes one byte per pixel, so it reads past the buffer. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when the victim pastes it, discloses megabytes of heap memory.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update FreeRDP to version 3.32.1. Red Hat Enterprise Linux 10 is affected and has no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA FreeRDP (FreeRDP) Fixed in 3.32.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
FreeRDP 3.32.1
5 records Highest priority Priority MEDIUM 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-78655 Use-after-free in FreeRDP drdynvc channel crashes clientsPriority MEDIUM 64
- TI-2026-78658 Heap buffer overflow in FreeRDP server audio channelPriority MEDIUM 40
- TI-2026-78657 Heap out-of-bounds read in FreeRDP Android client graphics pipelinePriority LOW 36
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114043
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-21 CVSS score added · Red Hat
- 2026-10-22 Priority changed: MEDIUM → LOW
- 2026-10-27 CISA SSVC decision points changed
- 2026-10-27 Priority changed: LOW → MEDIUM
References
More FreeRDP vulnerabilities
- TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
- TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
- TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
- TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
- TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
- TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-114043 · CVE Program
- CVE-2026-114043 · NVD
- FIRST EPSS
- CVE-2026-114043 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences