FreeRDP CVE-2026-121386

Exploitation requires a FreeRDP client built with the WINPR_UTILS_IMAGE_PNG and/or WINPR_UTILS_IMAGE_JPEG code paths enabled - the official deb-nightly (cmake-preload.cmake) and flatpak (com.freerdp.FreeRDP.json) packaging turn these ON, so stock packages are affected, but builds using WITH_LODEPNG are NOT affected by the PNG case because lodepng returns error codes. The attacker must be a malicious RDP server or a MITM on the session, and must get a malformed-image clipboard format (image/png or image/jpeg) offered and synthesized on the client; the crash occurs 'when the format is used,' implying the clipboard image path must actually be exercised rather than merely offered. Affected versions are FreeRDP <= 3.32.1; no client-side authentication is required by the attacker. The only complete fix stated is updating to 3.32.2.

Multiple signals point to a genuinely easy-to-trigger but strategically limited issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and score of 8.7 are driven almost entirely by VA:H combined with network reach and no required privileges - confidentiality and integrity impact are both N, so the only outcome is availability loss (client process termination). This is a CWE-248 uncaught-exception DoS, not code execution: libpng's default handler reaches abort() (SIGABRT) and libjpeg's default error_exit calls exit(), killing the client. The vuln.today priority is this_week, consistent with a trivially reproducible remote crash (a 12-byte PNG or 62-byte JPEG suffices). However, it is NOT in CISA KEV and no EPSS probability was supplied in the input, so there is no evidence of active or widespread exploitation; impact is confined to crashing an individual client with no persistence, lateral movement, or data exposure. Net: a real, reportable remote DoS worth patching promptly, but the high CVSS overstates operational danger relative to RCE-class flaws - the ceiling is a crashed RDP client. One caveat to verify: the clipboard image conversion only runs 'when the format is used,' which can imply some client-side clipboard activity that the clean AV:N/UI:N vector does not reflect - verify trigger conditions against the advisory's reachability notes.

A victim connects a FreeRDP client (built with PNG/JPEG image support, which the official deb-nightly and flatpak packaging enable) to an attacker-controlled RDP server, or an attacker holds a MITM position on an existing session. The server offers a malformed PNG or truncated JPEG as a clipboard image payload; when the client synthesizes that clipboard format it calls the unguarded WinPR image readers, and the underlying library aborts or exits, terminating the client. The GHSA advisory includes a libFuzzer harness and base64-encoded crash artifacts, so a public DoS proof-of-concept exists; the impact is denial of service only, not code execution.