CVE-2026-110839 in FreeRDP
Summary
by MITRE • 10/15/2026
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical heap-based out-of-bounds write flaw located within the winpr_convert_from_jpeg function, specifically triggered when the library is compiled with JPEG utility support enabled via WINPR_UTILS_IMAGE_JPEG=ON. This defect arises from an incorrect assumption regarding color channel dimensions during image processing operations. When handling grayscale JPEG images, the code allocates a buffer based on the size of a single input component rather than accounting for the three BGR output components required by downstream rendering processes. This miscalculation results in a destination buffer that is significantly smaller than what is actually written to it during the conversion process, leading directly to memory corruption.
From an operational perspective, this vulnerability can be exploited through clipboard redirection mechanisms inherent to Remote Desktop Protocol connections. A malicious RDP server can craft and deliver a specially constructed grayscale JPEG image embedded within clipboard data. When the remote user attempts to paste this item as CF_DIB bitmap data into a local application, the FreeRDP client processes the image using the flawed conversion routine. The subsequent out-of-bounds write corrupts adjacent heap memory structures, which typically leads to immediate application crashes or denial of service conditions for the RDP session. In more sophisticated attack scenarios involving precise control over the corrupted memory layout, this flaw could potentially be leveraged to achieve arbitrary code execution on the client system by manipulating function pointers or exception handlers located in nearby memory regions.
This vulnerability aligns with CWE-787, which classifies out-of-bounds writes that occur when a program writes data beyond the boundaries of a buffer, and CWE-134, concerning the use of externally-controlled format strings if such exploitation paths exist within related parsing logic, though the primary classification remains memory corruption. In terms of adversary tactics, this flaw facilitates techniques associated with MITRE ATT&CK Tactic TA0005 Defense Evasion or TA0002 Execution, as an attacker could utilize clipboard redirection to introduce malicious payloads into a restricted environment without direct file system access. The reliance on clipboard data also touches upon input validation failures typical of CWE-20 Improper Input Validation, where the software fails to adequately verify that image dimensions and color depths match expected buffer allocations before processing.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.32.0 or later, where this allocation logic has been corrected to properly account for all three BGR components when handling grayscale inputs. For environments unable to immediately patch the software, administrators should restrict clipboard redirection permissions within Group Policy settings to prevent untrusted RDP servers from injecting arbitrary image data into client sessions. Additionally, deploying network-level authentication and ensuring that only trusted remote desktop hosts are accessible can reduce the attack surface presented by this vulnerability. Security teams should also monitor for anomalous memory usage patterns in FreeRDP processes, as heap corruption often manifests through unusual resource consumption or instability prior to a crash event.