Uncaught Exception in FreeRDP - #VU156163
Published: October 19, 2026 / Updated: October 19, 2026
Vulnerability identifier: #VU156163
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by aborting the FreeRDP client process.
The vulnerability exists due to missing library error handling in winpr_read_png_from_buffer() when decoding malformed PNG clipboard content supplied by an RDP peer. A remote attacker can offer a malformed PNG clipboard payload that is processed during clipboard conversion to trigger libpng's error handler without an initialized jump target, causing the client process to abort.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.32.2