Search: CVE-2026-110839

FreeRDP versions before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, contain a heap-based out-of-bounds write vulnerability in the winpr_convert_from_jpeg function. This occurs because grayscale JPEG buffers are sized incorrectly, leading to memory corruption when a malicious RDP server sends a grayscale JPEG via clipboard redirection. The client may crash when pasting the clipboard item as CF_DIB bitmap data. The vulnerability has a CVSS score of 7.1 (high severity) and is fixed in version 3.32.0.