FreeRDP CVE-2026-110839

Exploitation requires a FreeRDP client compiled with the non-default WINPR_UTILS_IMAGE_JPEG=ON option (affected versions 3.3.0 up to but not including 3.32.0), with clipboard redirection active during an RDP session. The victim must connect to an attacker-controlled or compromised RDP server AND must then actively paste the malicious grayscale JPEG clipboard item as CF_DIB bitmap data - the undersized buffer is only allocated at paste time, so passive user interaction (UI:P) gates the entire chain. These factors - non-default JPEG build flag, required outbound connection to a hostile server, and the mandatory paste action - substantially limit realistic exploitation despite the network attack vector.

This is a moderate-risk, availability-focused memory-corruption bug rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H) correctly captures the defining constraint: although the attack is network-delivered and needs no authentication on the victim client, it requires passive user interaction (UI:P) - the victim must paste attacker-controlled clipboard data - and the demonstrated impact is a client crash (VA:H) with only low integrity impact (VI:L) and no confidentiality loss. No EPSS score, KEV listing, or POC is present in the input, so under the precision rules this is 'no public exploit identified at time of analysis'; the absence of these signals is consistent with a newly disclosed issue (VulnCheck advisory) and argues against treating it as urgent. A key nuance: the flaw only exists when FreeRDP is compiled with the non-default WINPR_UTILS_IMAGE_JPEG=ON option, which sharply narrows the real-world exposed population below what AV:N alone implies. While a heap out-of-bounds write can theoretically escalate beyond denial-of-service, the description and assigned impact metrics describe memory corruption leading to a crash, not confirmed code execution - this should be verified with the vendor before assuming RCE.

A user of a vulnerable FreeRDP client (built with JPEG support) connects to a malicious or compromised RDP server that has clipboard redirection enabled. The server places a specially crafted grayscale JPEG on the shared clipboard; when the victim pastes it as a CF_DIB bitmap, FreeRDP allocates an output buffer sized for one input component instead of three BGR output components, triggering a heap-based out-of-bounds write that corrupts memory and crashes the client. No public exploit code is identified at time of analysis, and the required paste interaction (UI:P) limits reliable mass exploitation.