CVE-2026-110839

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause client memory corruption and a Denial of Service (DoS) by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap data during a paste operation, an incorrect buffer size calculation causes data to be written beyond the allocated heap boundaries, crashing the application.

This flaw is rated Important because a malicious RDP endpoint can trigger a heap out-of-bounds write during JPEG clipboard conversion after the user connects (UI:R), impacting integrity and availability (CVSS 7.1). Platform hardening may impede reliable exploitation but does not remove I:L/A:H from the base score.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If clipboard redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.