CVE-2026-121386

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description An issue exists in WinPR where the functions winpr read png from buffer() and winpr convert from jpeg() lack proper error handling for libpng and libjpeg. A malicious RDP server or a man-in-the-middle attacker can send a malformed PNG or a truncated JPEG clipboard payload, which leads to the client aborting or exiting, resulting in a denial of service.

Recommendations Update to version 3.32.2 or later.