CVE-2026-110839
7.1HighPublished 14 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on availability
- Weakness
- CWE-787
Impact
A malicious RDP server can crash your client and corrupt its memory when you paste clipboard content. This requires an active connection to the malicious server and a user pasting the offered clipboard item as CF_DIB bitmap data.
Root cause
The winpr_convert_from_jpeg function allocates memory sized for single-component grayscale input instead of three-component BGR output, leading to a heap-based buffer overflow.
Affected systems
FreeRDP 3.3.0 before 3.32.0 (when compiled with WINPR_UTILS_IMAGE_JPEG=ON)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Fix & remediation
Upgrade FreeRDP to version 3.32.0 or later. If you cannot immediately patch, disable clipboard redirection in client connections or recompile FreeRDP with WINPR_UTILS_IMAGE_JPEG=OFF.
$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.