{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/freerdp--3.32.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-121386"},{"cvss":7.5,"id":"CVE-2026-121951"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeRDP (\u003c 3.32.2)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","rdp"],"_cs_type":"advisory","_cs_vendors":["FreeRDP"],"content_html":"\u003cp\u003eFreeRDP versions before 3.32.2 contain a denial of service vulnerability located in the WinPR library's \u003ccode\u003ewinpr_read_png_from_buffer()\u003c/code\u003e and \u003ccode\u003ewinpr_convert_from_jpeg()\u003c/code\u003e functions. The vulnerability stems from insufficient error handling when interacting with the \u003ccode\u003elibpng\u003c/code\u003e and \u003ccode\u003elibjpeg\u003c/code\u003e libraries. An attacker acting as a malicious RDP server or performing a man-in-the-middle (MITM) attack can trigger this flaw by providing a malformed PNG or a truncated JPEG payload via the RDP clipboard channel. Successful exploitation causes the FreeRDP client process to abort or terminate unexpectedly.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated remote attacker to cause a denial of service by crashing the client application. No code execution is documented as part of this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate all instances of the FreeRDP client to version 3.32.2 or later immediately to incorporate the required error handling for image processing functions.\u003c/p\u003e\n","date_modified":"2026-11-04T16:50:10Z","date_published":"2026-11-03T20:00:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-freerdp-dos/","summary":"FreeRDP versions prior to 3.32.2 are susceptible to a denial of service vulnerability in WinPR due to missing error handling for libpng and libjpeg, which can be triggered by a malicious RDP server or a man-in-the-middle attacker providing malformed clipboard image payloads.","title":"FreeRDP: Denial of Service in WinPR via malformed clipboard images (CVE-2026-121386)","url":"https://feed.craftedsignal.io/briefs/2026-11-freerdp-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeRDP (\u003c 3.32.2)","version":"https://jsonfeed.org/version/1.1"}