CVE-2026-114043

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.1

Description A heap-based out-of-bounds read exists in the WinPR clipboard PNG-to-CF DIB synthesis. The issue occurs because the winpr read png from buffer() function allocates a bit-packed buffer for PNG images with a bit depth below 8, whereas the winpr bitmap write buffer() function copies rows under the assumption that each pixel occupies one byte. A malicious RDP server can exploit this by sending a specially crafted low-bit-depth PNG clipboard payload, which may lead to the disclosure of megabytes of heap memory when the victim pastes the content.

Recommendations Update to version 3.32.1.