FreeRDP CVE-2026-111881

Exploitation requires the victim to connect with a FreeRDP client (version 3.14.1 up to but not including 3.32.0) to an attacker-controlled or compromised RDP server, AND for clipboard redirection/synchronization to be active so that clipboard_synthesize_image_format_to_bmp processes a server-supplied image for the CF_DIB/CF_DIBV5 formats. The attacker must deliver a crafted 1-bpp (sub-byte) BMP whose stride calculation underflows. Limiting factors: this is client-side only (the attacker cannot reach a listening service), it requires user interaction to establish the connection (UI:P), it requires clipboard image sync to be in use, and it is confined to the affected FreeRDP version range; it does not affect default server deployments and is not wormable.

This is a client-side FreeRDP vulnerability whose provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H) yields a 7.2 (High) score driven largely by the availability impact (VA:H, i.e. client crash) rather than by reliable code execution. The AV:N is technically correct but misleading in isolation: the attacker must operate a malicious RDP peer AND the victim must actively connect to it and use clipboard synchronization (UI:P), so this is NOT a remotely-triggerable, unauthenticated server-side flaw - it is a reverse/client-targeted bug requiring the victim to initiate the connection. No EPSS score was supplied in the input, so exploitation-probability modeling is unavailable; the CVE is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The description notes two outcomes - a guaranteed crash and a possible out-of-bounds write - but does not confirm the OOB write is controllable into code execution, so treat the integrity/confidentiality (VC:L/VI:L) ratings as denial-of-service-leaning rather than confirmed RCE. Net: a genuine but moderate-priority client-side issue for environments where users connect to untrusted RDP servers, not a mass-exploitation or internet-facing-server emergency.

An attacker stands up or compromises an RDP server and lures a victim (e.g. via a phishing link or malicious .rdp file) into connecting with a FreeRDP-based client that has clipboard redirection enabled. When clipboard image synchronization occurs, the malicious server returns a crafted 1-bpp BMP for CF_DIB/CF_DIBV5, triggering an integer underflow (SIZE_MAX-3 passed to Stream_Zero) that crashes the client or causes an out-of-bounds write. No public exploit is identified at time of analysis; exploitation requires the user to initiate the connection (UI:P).