CVE-2026-121397

MediumCVSS 4.3/10Last modified Nov 3, 2026

Description

FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2026
Last modified
Nov 3, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-1213985.9FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardCVE-2026-1213994.3FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB cCVE-2026-1214006.5FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaustCVE-2026-1214014.3FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH_MSG without veCVE-2026-1214026.5FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sendiCVE-2026-1214034.3FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE bodCVE-2026-1214046.5FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server tCVE-2026-1214054.3FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excesCVE-2026-1214064.3FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative zgfx_decompress status and passeCVE-2026-1214076.5FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clieCVE-2026-1214085.3FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer withCVE-2026-1214095.9FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or
CVE-2026-121397: Medium severity, CVSS 4.3 | Vulnix