Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3307)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3307 advisory. FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values...

SUSE CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

A flaw was found in FreeRDP. WinPR's clipboard PNG-to-CFDIB synthesis allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when paste...

DEBIAN-CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043 Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043 Vulnerability in FreeRDP

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

EUVD-2026-106994

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

CVE-2026-114043

FreeRDP versions before 3.32.1 are vulnerable to a heap-based out-of-bounds read within the WinPR clipboard PNG-to-CF_DIB synthesis component. The root cause is that winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with a bit depth below 8, while winpr_bitmap_write_buffer() inc...

CVE-2026-114043

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can...

PT-2026-120169

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF DIB synthesis because winpr read png from buffer allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr bitmap write buffer copies rows assuming one byte per pixel. A malicious RDP...

Linux Distros Unpatched Vulnerability : CVE-2026-109248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled...

Linux Distros Unpatched Vulnerability : CVE-2026-109256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A maliciou...

Linux Distros Unpatched Vulnerability : CVE-2026-114043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CFDIB synthesis because winprreadpngfrombuffer allocates a bit-packed...

SUSE CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

DEBIAN-CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111881

The FreeRDP software versions 3.14.1 through 3.31.x are vulnerable to an integer underflow in the WinPR BMP writer . The issue occurs when a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero during the processing of sub-byte images. A malicious RDP clipboard peer can trigger this b...

EUVD-2026-103337

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...