FreeRDP CVE-2026-114043

Exploitation requires (1) the victim's FreeRDP/WinPR-based client to connect to an attacker-controlled or compromised RDP server, (2) the clipboard redirection (CLIPRDR) channel to be active so the server can push clipboard formats, and (3) the victim to actually paste the attacker-supplied clipboard content, which triggers the PNG-to-CF_DIB conversion. The specific trigger is a crafted PNG with bit depth below 8 bits/pixel, where winpr_read_png_from_buffer() allocates a bit-packed buffer but winpr_bitmap_write_buffer() copies rows at one byte per pixel, reading out of bounds. Limiting factors: this is a client-side flaw (attacker must control the server, not a listening service), it needs user interaction (the paste), and impact is limited to heap memory disclosure (no code execution). Affected: FreeRDP before 3.32.1.

This is a client-side heap out-of-bounds read (CWE-125) with information-disclosure impact only. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) scores 7.1 and correctly captures the key tension: the attack is network-reachable and requires no attacker authentication, but it is NOT a drive-by remote exploit - the UI:P (passive user interaction) flag reflects that the victim must both connect to an attacker-controlled RDP server AND actively paste the malicious clipboard content before the leak triggers. Impact is confidentiality-only (VC:H, VI:N/VA:N) - up to megabytes of heap memory disclosed, with no code execution or integrity/availability effect, so the 'Buffer Overflow' tag overstates it; this is a read primitive, not a write/overflow. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimate but moderate-priority issue - meaningful because it enables memory disclosure (potentially leaking secrets/credentials from client heap) against widely-used RDP client software, but materially constrained by the requirement to lure a victim onto a hostile server and have them paste. Prioritize patching for environments where users connect out to untrusted or third-party RDP endpoints; lower urgency where clients only reach trusted internal servers.

An attacker operates or compromises an RDP server and lures a victim into connecting to it (e.g., a malicious remote-support session or a spoofed corporate gateway). The server sends a crafted low-bit-depth (<8bpp) PNG clipboard payload; when the victim copies/pastes clipboard data during the session, WinPR's PNG-to-CF_DIB synthesis reads past the under-allocated bit-packed buffer and returns megabytes of adjacent client heap memory to the attacker-controlled server. No public exploit code is identified at time of analysis, but the bug is well-specified in the FreeRDP advisory.