CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png write data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.