CVE Alert: CVE-2026-121386 – FreeRDP

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR’s winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.

**Risk verdict:** This is a high-impact availability risk for reachable clients; no KEV, SSVC, PoC or EPSS data is supplied, so exploitation urgency and prevalence remain uncertain.

**Why this matters:** A successful attack can terminate a client session, disrupting remote work or administration and potentially forcing repeated reconnects. Likely goals are denial of service, interruption of operations, or frustrating users during sensitive maintenance—not data theft or system modification through this flaw.

**Most likely attack path:** An attacker needs to control or intercept an RDP connection and deliver crafted image data; network reachability is required, but no account privileges or user action are indicated. Scope is unchanged, so impact appears confined to the affected client process or host’s availability, with no direct lateral movement indicated.

**Who is most exposed:** Prioritise organisations using FreeRDP-based clients, gateways, embedded systems or custom remote-access tools, especially where users connect to untrusted or third-party servers.

Correlate client crashes or abrupt exits with RDP sessions and clipboard image activity.

Review logs for repeated reconnects or process restarts involving remote desktop clients.

Preserve crash dumps and application logs to identify image-decoding failures.

Alert on unusual RDP connections from untrusted networks or unexpected servers.

Mitigation and prioritisation

Upgrade to the vendor-fixed release; inventory bundled and embedded copies as well as standalone clients.

Until patched, restrict connections to trusted servers and block unneeded clipboard redirection.

Apply changes through normal testing and deployment controls, prioritising internet-facing or widely deployed clients.

Confirm whether exploitation or PoC reporting exists before assigning a higher urgency; the supplied data does not establish this.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.