CVE-2026-111881

7.6High

Published 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.6High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-191

Impact

A malicious RDP peer can crash your FreeRDP client or trigger an out-of-bounds write. They need the user to establish an RDP session and interact with the shared clipboard.

Root cause

An integer underflow in the WinPR BMP writer's stride calculation passes SIZE_MAX - 3 to Stream_Zero when handling crafted 1-bpp images.

Affected systems

FreeRDP 3.14.1 before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Fix & remediation

Upgrade FreeRDP to version 3.32.0 or later. As an interim workaround, disable clipboard synchronization in your RDP client connections.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111881