Heap Buffer Over-Read in FreeRDP Affects Remote Desktop Protocol Services

CVE-2026-121397

What is CVE-2026-121397?

An identified weakness in FreeRDP prior to version 3.32.2 exists, where a heap buffer over-read can be exploited during the process of converting clipboard images from RDP servers. This vulnerability allows attackers to manipulate RDP sessions by serving CF_DIB BI_BITFIELDS images that may lead to the leakage of sensitive client memory into the clipboard. As a result, crucial data contained in the client heap can be extracted maliciously by unauthorized entities through a compromised RDP server.

References