CVE-2026-121397

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A heap buffer over-read occurs in the save png to buffer() function. This issue allows a malicious RDP server to leak client memory by sending 16 bpp DIB clipboard data. An attacker can provide a CF DIB BI BITFIELDS image which, during conversion to PNG for a local application, embeds client heap bytes into the clipboard image.

Recommendations Update to version 3.32.2 or later.