# CVE-2026-114043: FreeRDP heap-based out-of-bounds read in WinPR clipboard PNG synthesis

Source: https://junglewise.ai/threats/cve-2026-114043-freerdp-before-3-32-1-contains-a-heap-based-out-of-bounds-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114043 · Severity: medium · CVSS 6.5 · Published 2026-10-21

FreeRDP is a remote desktop protocol client that allows users to connect to Windows systems. A vulnerability in its clipboard handling allows a malicious RDP server to send a specially crafted PNG image that, when a user attempts to paste it, leaks several megabytes of sensitive heap memory from the victim's machine. An attacker can use this to extract confidential data that happens to be in adjacent memory.

Technologies: [FreeRDP Project FreeRDP](https://junglewise.ai/threats/technologies/freerdp-project-freerdp). Vendors: [FreeRDP Project](https://junglewise.ai/threats/vendors/freerdp-project).

## Quick answers

**Is CVE-2026-114043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114043 being exploited in the wild.

**How severe is CVE-2026-114043?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** FreeRDP Project FreeRDP before 3.32.1.

**Is there a fix for CVE-2026-114043?** Yes: fixed in 3.32.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114043 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114043?** Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.1

## Technical details

A heap-based out-of-bounds read in WinPR's PNG-to-CF_DIB clipboard synthesis occurs because winpr_read_png_from_buffer() allocates a bit-packed buffer for low-bit-depth PNGs (1-, 2-, or 4-bit), but winpr_bitmap_write_buffer() copies rows assuming one byte per pixel, leading to reads far beyond the allocated region. The vulnerability requires WINPR_UTILS_IMAGE_PNG=ON (enabled by default in official Android and iOS clients) and is triggered when a user pastes a crafted PNG clipboard payload from a malicious RDP server into a local application.

## Affected products

- FreeRDP Project FreeRDP before 3.32.1

## Timeline

- 2026-10-05: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f3vg-h45x-6wgf](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f3vg-h45x-6wgf)
- [https://www.vulncheck.com/advisories/vulnerability-in-freerdp](https://www.vulncheck.com/advisories/vulnerability-in-freerdp)

## Related threats

- [FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in)
- [FreeRDP use-after-free in DRDYNVC tracker race condition](https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in)
- [FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing)
- [FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference)