DEBIAN-CVE-2026-109256

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

EUVD-2026-97700

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109256

FreeRDP versions 3.10.0 through 3.32.2 are vulnerable to a heap buffer overflow within the WinPR png_write_data callback. The root cause is a failure to handle a realloc failure , which allows a malicious RDP clipboard peer to trigger an out-of-bounds memcpy by supplying a large CF_DIB image duri...