Advisory · CVE-2026-121386
FreeRDP client denial of service via malformed clipboard images
FreeRDP before 3.32.2 aborts or exits the client process when a malicious RDP server or man-in-the-middle offers a malformed PNG or truncated JPEG clipboard payload, because the WinPR image readers call libpng and libjpeg without the error-handling context those libraries require.
- Vendor
- FreeRDP
- Product
- FreeRDP
- Identifier / CWE
- CVE-2026-121386
CWE-248 - Action timing
- Immediate
Explain it like I’m five
The image reader trusts the picture library to complain politely about a broken picture, but it never installed the safety net the library needs. A broken picture therefore kills the whole program instead of just failing that one picture.
- 01Malicious clipboard offered
A malicious RDP server, or a man-in-the-middle on the connection, offers an image-format clipboard payload.
- 02Clipboard conversion triggered
The FreeRDP client converts the offered clipboard data through the WinPR image readers when the format is used.
- 03Error handling missing
The PNG reader calls libpng without setting the jump target its default error handler needs, and the JPEG reader uses libjpeg with its default error handler, which exits directly.
- 04Client process dies
A malformed PNG as small as 12 bytes aborts the client, and a truncated JPEG exits it, ending the session deterministically.
What happened
FreeRDP before 3.32.2 contains a denial of service vulnerability in the WinPR image readers used for clipboard synthesis. The PNG reader creates the libpng structures and calls the read routine without installing the error-handling jump target, so a malformed PNG makes libpngs default error handler abort the process; the vendor advisory reproduces this with a 12-byte input. The JPEG reader uses libjpegs default error handler, which calls exit directly, so a truncated JPEG terminates the process instead of returning an error. Both readers consume attacker-controlled bytes supplied by the RDP peer through clipboard format conversion. The record rates it high at CVSS 8.7 under version 4.0.
The advisory is explicit about the limits of the impact: the process terminates deterministically, with no memory corruption and no code execution, but the session dies and unsaved state in cooperating local applications is lost, and repeatedly offering the format can keep the client unusable. The vendor 3.32.2 release is a security release that lists this advisory among the addressed CVEs, and the NVD affected range ends before 3.32.2. Builds using the lodepng path for PNG are not affected by the PNG case, since that path returns error codes.
What to do
- Inventory FreeRDP clients and record each version, including clients embedded in other tools.
- Upgrade to FreeRDP 3.32.2 or later.
- Until upgraded, connect only to trusted RDP servers, and consider disabling clipboard redirection for sessions with untrusted servers.
- Treat repeated unexpected client crashes during sessions with untrusted servers as a possible trigger of this issue and investigate the peer.
- Verify the deployed version after updating.
Management note
A client-side crash from untrusted peer data is easy to dismiss until it becomes a reliable way to kill sessions. The fix is a routine upgrade, but the pattern matters: any library with a fatal default error path needs its error handling installed before it touches untrusted input.