FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3… (CVE-2026-111881)

The vulnerability in FreeRDP (CVE-2026-111881) involves an integer underflow in the WinPR BMP writer component. Specifically, a mismatched stride calculation leads to passing SIZE_MAX - 3 to the Stream_Zero function when handling sub-byte images. This occurs when a malicious RDP clipboard peer returns a crafted 1-bit-per-pixel BMP image processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5 formats. The flaw can cause a crash or out-of-bounds write in the client application. The affected versions are from 3.14.1 before 3.32.0. The CVSS v3.1 score is 7.6 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to a client crash or an out-of-bounds write, which may allow an attacker to execute arbitrary code or cause denial of service. The vulnerability affects the clipboard handling functionality in FreeRDP, specifically when processing crafted BMP images from an RDP clipboard peer. The attack requires user interaction and network access but no privileges or authentication.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when accepting clipboard data from untrusted RDP peers and consider disabling clipboard redirection if feasible.