FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc… (CVE-2026-109256)

CVE-2026-109256 describes a heap buffer overflow in FreeRDP versions 3.10.0 through 3.32.2 within the WinPR png_write_data callback function. The overflow happens after a realloc failure when processing clipboard data containing a large CF_DIB image. This leads to an out-of-bounds memcpy during PNG conversion, resulting in a client crash. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, high attack complexity, no privileges required, and user interaction needed.

The vulnerability causes a denial of service by crashing the FreeRDP client when processing specially crafted clipboard data. There is no impact on confidentiality or integrity. Exploitation requires a malicious RDP clipboard peer and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when accepting clipboard data from untrusted RDP peers. No official fix or workaround information is provided in the current data.