CVE-2026-111881

HIGH 7.6

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

CWE	CWE-191
Vendor	freerdp
Product	freerdp
Published	Oct 17, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new high vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Affected Versions

FreeRDP / FreeRDP

3.14.1 < 3.32.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-27m7-gwhh-6hhf vulncheck.com: https://www.vulncheck.com/advisories/freerdp-3.14.1-before-3.32.0-integer-underflow-in-bmp-writer-via-clipboard

Credits

Kushalkhemka opensec-intelligence mayank-jangid-moon skigeek16