CVE-2026-121386

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server or a man-in-the-middle network attacker can cause a Denial of Service (DoS) by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processing the invalid image buffer causes the client application to abruptly abort or exit.

This vulnerability is rated as an Important impact for Red Hat products because an untrusted remote desktop host or network intermediary can terminate the client session unexpectedly without prior authentication. Although this defect causes application termination rather than remote code execution, it directly impacts the availability of user sessions in enterprise environments. Exploitation requires an established connection to a malicious RDP endpoint or interception by an adversary on the network path processing shared clipboard content.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable clipboard redirection for RDP connections.

When launching sessions with the xfreerdp command-line utility, explicitly disable the clipboard channel:

xfreerdp -clipboard /v:<server_address>

When connecting via graphical clients, disable clipboard synchronization within the respective connection profile preferences.

Caveats: Disabling clipboard redirection prevents transferring text, images, or files between the local system and the remote session.

Warning: Changes apply to new connections; any active RDP sessions must be disconnected and restarted for the setting to take effect.