FreeRDP CVE-2026-109256

Exploitation requires the victim's FreeRDP client to engage in a clipboard transfer with a malicious RDP peer and receive a crafted, oversized CF_DIB (device-independent bitmap) image that is processed by WinPR's PNG conversion path. The out-of-bounds write only occurs after a realloc() failure inside the png_write_data callback, so it depends on a memory-allocation failure condition (reflected as AT:P in the CVSS vector) rather than firing deterministically. Limiting factors: the attack targets the client side (victim must connect to or accept a clipboard peer controlled by the attacker), requires user/application interaction with the clipboard channel (UI:P), affects only versions 3.10.0-3.32.2, and yields only a crash (availability), not code execution or data disclosure.

This is a high-CVSS-category-but-moderate-real-risk issue, correctly scored MEDIUM (6.0). The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H) shows the only impact is availability (VA:H) - a client crash - with no confidentiality or integrity loss, so this is a denial-of-service, not code execution, despite the CWE-122 heap-overflow classification. Several signals dampen urgency: exploitation requires a present attack condition (AT:P), namely a realloc failure that only occurs under memory pressure, and passive user interaction (UI:P) via the clipboard channel. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The primary caveat: the attack is against the RDP *client*, and requires the victim to connect to (or accept a clipboard peer from) a malicious RDP server/peer and trigger a CF_DIB clipboard transfer - this is a client-side, interaction-and-condition-gated DoS rather than a server-side wormable flaw. Treat as a patch-in-normal-cycle issue, not an emergency.

A victim using a FreeRDP-based client (3.10.0-3.32.2) connects to an attacker-controlled or compromised RDP peer. During a clipboard exchange the malicious peer supplies an oversized CF_DIB bitmap; when WinPR converts it to PNG and a realloc fails under memory pressure, the png_write_data callback performs an out-of-bounds memcpy, crashing the client. No public exploit code was identified in the provided data.