PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110839 FreeRDP CVE debrief

FreeRDP 3.3.0 before 3.32.0 is vulnerable to a heap-based out-of-bounds write in winpr_convert_from_jpeg due to improper sizing of grayscale JPEG buffers. This issue, present when built with WINPR_UTILS_IMAGE_JPEG=ON, can lead to memory corruption and crashes when pasting grayscale JPEG data as CF_DIB bitmap data. Defenders should assess their exposure, particularly in environments with untrusted RDP servers, and prioritize updating to version 3.32.0 or later. The vulnerability stems from the library's handling of grayscale JPEG buffers, which are sized based on a single input component rather than three BGR output components.

Vendor
FreeRDP
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for FreeRDP installations, particularly those exposed to untrusted RDP servers, should assess their exposure and prioritize updating to version 3.32.0 or later.

Why it matters

Defenders should prioritize verifying and updating FreeRDP installations to prevent potential memory corruption and crashes due to a heap-based out-of-bounds write in FreeRDP 3.3.0 before 3.32.0.

  • Potential memory corruption and crashes when pasting grayscale JPEG data as CF_DIB bitmap data
  • Verification of FreeRDP installations and updates to prevent potential issues
  • Monitoring for potential memory corruption and crashes

Technical summary

FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output components. This vulnerability can lead to memory corruption and crashes when pasting grayscale JPEG data as CF_DIB bitmap data. The issue arises from the library's improper handling of grayscale JPEG buffers, highlighting the need for defenders to verify and update their FreeRDP installations.

Defensive priority

Defenders should prioritize verifying and updating FreeRDP installations to prevent potential memory corruption and crashes.

Recommended defensive actions

  • Verify FreeRDP installations and update to version 3.32.0 or later
  • Assess exposure of FreeRDP installations to untrusted RDP servers
  • Implement additional monitoring for potential memory corruption and crashes
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on a heap-based out-of-bounds write in FreeRDP 3.3.0 before 3.32.0, built with WINPR_UTILS_IMAGE_JPEG=ON, due to improper sizing of grayscale JPEG buffers.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110839 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110839

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110839 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110839

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110839.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99p4-8j24-wvj4

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/freerdp-3.3.0-before-3.32.0-heap-out-of-bounds-write-via-grayscale-jpeg-clipboard-data

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.