FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a...
Summary
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a...
Original description
The description as published by the source.
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-111881 freerdp2
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com