4 matches found
EUVD-2026-101722
FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...
CVE-2026-110839
FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...
CVE-2026-110839
FreeRDP versions 3.3.0 before 3.32.0 are vulnerable to a heap-based out-of-bounds write when compiled with WINPR_UTILS_IMAGE_JPEG=ON. The root cause is located in winpr_convert_from_jpeg, where grayscale JPEG buffers are incorrectly sized from one input component instead of three BGR output compo...
CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
FreeRDP 3.3.0 before 3.32.0, when built with WINPRUTILSIMAGEJPEG=ON, has a heap-based out-of-bounds write in winprconvertfromjpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. A malicious RDP server can offer a grayscale JPEG via...