CVE-2026-110839
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
Risk Assessment
A malicious RDP server can remotely corrupt FreeRDP client memory and cause a crash, which may be used for denial of service and potentially for further exploitation.
Recommendation
Upgrade FreeRDP to version 3.32.0 or later; if not possible, consider disabling JPEG support at build time or restricting connections to untrusted RDP servers.
Other vulnerabilities in FreeRDP
See all- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
- CVE-2026-22856High
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2013-4119High
FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
- CVE-2013-4118High
FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash.
- CVE-2014-0250High
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the xf_Pointer_New or xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
- CVE-2026-91949Critical
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
- CVE-2026-63633Critical
In FreeRDP before 3.28.0, freerdp_dsp_decode_opus calls Stream_EnsureRemainingCapacity on the context buffer even though opus_decode writes to the caller-supplied stream. A malicious RDP server negotiating WAVE_FORMAT_OPUS can cause large decoded frames to be written beyond the allocated buffer, leading to client heap corruption, crash, and potential code execution.
- CVE-2026-55194Critical
In FreeRDP before 3.27.0, rpc_client_recv_fragment ensures response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a response with a small alloc_hint and a much larger frag_length, causing a buffer overflow in the pdu->s buffer. This can crash the client and may permit code execution.
- CVE-2026-55191Critical
In FreeRDP before 3.27.0, clients negotiating RDPGFX AVC444 calculate the intermediate YUV444 allocation size using 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions causing integer wrap, leading to an undersized buffer allocation. This can cause a client crash and may permit code execution.
- CVE-2026-73242Critical
FreeRDP, a free implementation of the Remote Desktop Protocol, prior to version 3.30.0 has a vulnerability in the kerberos_DecryptMessage function that fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets. A malicious RDP peer can trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption.
Original NVD description (English source)
FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via clipboard redirection, corrupting client memory and crashing it when the item is pasted as CF_DIB bitmap data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS