CVE-2026-121397

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can cause an information disclosure by sending crafted clipboard image data to a connected client. When the client converts the image into Portable Network Graphics (PNG) format, a heap buffer over-read occurs, embedding sensitive client heap memory into the resulting image.

This vulnerability is rated as Moderate impact because successful exploitation requires a user to connect to an untrusted RDP server, and the resulting memory over-read leaks client heap data rather than allowing arbitrary code execution or system compromise. In Red Hat enterprise environments, FreeRDP is typically deployed as an interactive client application or embedded library for remote desktop connectivity. The flaw can only be triggered during active remote desktop sessions where clipboard synchronization is enabled and incoming graphical clipboard content is processed. Consequently, exposure is limited to targeted user-driven sessions with untrusted remote endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable clipboard synchronization in RDP client connections:

1. When running command-line FreeRDP sessions, do not enable clipboard redirection (omit +clipboard or /clipboard, or explicitly pass -clipboard).
2. In graphical remote desktop managers that utilize FreeRDP (such as Remmina), disable clipboard synchronization in the connection profile settings under session options.
3. Avoid initiating remote desktop sessions to untrusted or unverified hosts.

Caveats: Disabling clipboard synchronization prevents copying and pasting data, including text and images, between the local desktop and the remote session.