Integer Underflow in FreeRDP Affecting Multiple Versions
CVE-2026-111881
7.2HIGH
What is CVE-2026-111881?
FreeRDP versions prior to 3.32.0 exhibit an integer underflow vulnerability in the WinPR BMP writer. This issue arises from incorrect stride calculations that can lead to a malicious RDP clipboard peer crafting a 1-bpp BMP, causing the client to crash or resulting in an out-of-bounds write due to the improper handling of the image format. Users of affected versions are encouraged to update to mitigate potential exploitation risks.
Affected Version(s)
FreeRDP 3.14.1 < 3.32.0
FreeRDP 3.32.0
References
CVSS V4
Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Kushalkhemka
opensec-intelligence
mayank-jangid-moon
skigeek16