{"id":"CVE-2026-121397","published":"2026-11-03T15:17:27.630","lastModified":"2026-11-03T17:18:08.667","description":"FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP servers to leak client memory by sending 16 bpp DIB clipboard data. Attackers can offer a CF_DIB BI_BITFIELDS image that, when converted to PNG for a local application, embeds client heap bytes into the clipboard image.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwes":["CWE-125"],"vendors":["freerdp"],"products":["freerdp"],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-3.32.2-heap-over-read-via-winpr-save-png-to-buffer","tags":["Third Party Advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","tags":["Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","tags":["Vendor Advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7w3-32ch-x2jq","tags":["Vendor Advisory"]}],"hasPoc":true,"ai":null}