CVE-2026-121397 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical security flaw within the remote desktop protocol implementation, specifically located in the save_png_to_buffer function responsible for handling clipboard data conversion. This issue is classified as a heap buffer over-read, which falls under CWE-126 and allows an attacker with access to a malicious Remote Desktop Protocol server to read arbitrary memory from the client system. The attack vector relies on the interaction between the remote session's clipboard functionality and the local image processing libraries used by FreeRDP to render or transfer data. When a user interacts with shared clipboard features, particularly when copying images from the remote environment to the local machine, the application processes incoming Data Interchange Format DIB bitmaps. The flaw occurs during the conversion of these 16-bit per pixel BI_BITFIELDS format images into PNG format for embedding in the local clipboard or display context.
The technical mechanism of this exploitation involves a mismatch between the expected data size and the actual bounds checked by the application logic within save_png_to_buffer. When a malicious RDP server sends crafted CF_DIB clipboard data utilizing the BI_BITFIELDS compression method, it can specify dimensions or pixel counts that exceed the allocated heap buffer boundaries without triggering appropriate validation errors. As FreeRDP attempts to decode this malformed image data and convert it for local use, the function reads beyond the end of the allocated memory block. This out-of-bounds read operation results in the inclusion of adjacent heap contents into the resulting PNG image data structure. Consequently, sensitive information residing in the client's memory space immediately following the buffer is inadvertently included in the clipboard payload or rendered output.
The operational impact of this vulnerability is significant as it facilitates a remote code execution precursor through information disclosure rather than direct code injection. By leveraging ATT&CK technique T1005 which covers Data from Local System, an attacker can systematically extract sensitive data such as authentication tokens, cryptographic keys, session cookies, or other proprietary application data stored in the client's memory heap. Since clipboard operations are a common feature used by administrators and developers to transfer content between remote workstations and local machines, this vulnerability presents a high-risk attack surface that is difficult for users to detect without specialized monitoring tools. The leaked data can be exfiltrated through standard copy-paste actions or automated scripts running on the client side if integrated with malicious software designed to harvest clipboard contents.
Mitigation strategies must prioritize immediate patching of the FreeRDP installation to version 3.32.2 or later, where this bounds checking logic has been corrected to ensure that all memory accesses remain within allocated limits regardless of input data characteristics. In environments where updating is not immediately feasible, network-level controls should be implemented to restrict RDP connections to trusted and verified servers only, thereby reducing the attack surface exposed to malicious actors. Additionally, organizations should consider disabling clipboard sharing features for untrusted remote sessions or implementing strict content filtering on incoming DIB images before they are processed by the image conversion routines. Security teams should also monitor for anomalous memory access patterns in FreeRDP processes and ensure that endpoint detection systems are configured to alert on potential heap corruption events associated with this specific function signature.