CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol (RDP) session can exploit this by supplying a specially crafted bitmap image through clipboard data exchange. This flaw can cause the client application to crash, leading to a Denial of Service (DoS), or potentially result in an out-of-bounds memory write.

This flaw is triggered when a FreeRDP client processes crafted clipboard bitmap data from a malicious RDP peer, so User Interaction is Required. Availability is High due to a reliably demonstrated client crash from an integer underflow in the BMP writer. Confidentiality and Integrity are Low for a potential follow-on out-of-bounds write that was not shown to yield controlled corruption or code execution. Red Hat rates this Important (CVSS 7.6). ASLR, NX, and FORTIFY_SOURCE may further limit exploitation beyond denial of service, but they do not eliminate the crash, so Availability remains High.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Connect FreeRDP clients only to trusted remote peers and avoid accepting clipboard content from untrusted RDP sessions. If clipboard redirection is not needed, disable clipboard sharing in the FreeRDP client.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to disable clipboard redirection in FreeRDP client sessions connecting to untrusted RDP peers to prevent WinPR BMP writer stride underflow during sub-byte image synthesis: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which correct sub-byte stride calculation in the BMP writer to match four-byte alignment and prevent underflow before calling Stream_Zero, closing all 2 injection vectors (crafted 1-bpp bitmap returned via RDP clipboard channel, clipboard image synthesis for CF_DIB or CF_DIBV5 formats). Until patched, this is a concern on FreeRDP client hosts connecting to untrusted RDP peers with clipboard redirection enabled, so connect FreeRDP clients only to trusted remote peers and disable clipboard sharing or avoid requesting clipboard image data in CF_DIB or CF_DIBV5 formats from untrusted RDP sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer underflow defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)