CVE-2026-109256
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.