FreeRDP (< 3.32.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/freerdp--3.32.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:00:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFreeRDP: Denial of Service in WinPR via malformed clipboard images (CVE-2026-121386)https://feed.craftedsignal.io/briefs/2026-11-freerdp-dos/Tue, 03 Nov 2026 20:00:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-freerdp-dos/FreeRDP versions prior to 3.32.2 are susceptible to a denial of service vulnerability in WinPR due to missing error handling for libpng and libjpeg, which can be triggered by a malicious RDP server or a man-in-the-middle attacker providing malformed clipboard image payloads.FreeRDP versions before 3.32.2 contain a denial of service vulnerability located in the WinPR library's winpr_read_png_from_buffer() and winpr_convert_from_jpeg() functions. The vulnerability stems from insufficient error handling when interacting with the libpng and libjpeg libraries. An attacker acting as a malicious RDP server or performing a man-in-the-middle (MITM) attack can trigger this flaw by providing a malformed PNG or a truncated JPEG payload via the RDP clipboard channel. Successful exploitation causes the FreeRDP client process to abort or terminate unexpectedly.

Impact

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by crashing the client application. No code execution is documented as part of this vulnerability.

Recommendation

Update all instances of the FreeRDP client to version 3.32.2 or later immediately to incorporate the required error handling for image processing functions.

]]>lowadvisorydenial-of-servicerdp