CVE-2026-114043 Vulnerability in FreeRDP
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114043?
CVE-2026-114043 is a high-severity vulnerability in FreeRDP, published on 21 Oct 2026.
Official description
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when pasted by the victim, discloses megabytes of heap memory.
Weakness: CWE-125
Which versions are affected by CVE-2026-114043?
How do I fix CVE-2026-114043?
Upgrade to a fixed version.
Is CVE-2026-114043 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114043 exists.
Sources
Also known as DEBIAN-CVE-2026-114043, GHSA-f3vg-h45x-6wgf, GHSA-wfxj-44r2-v2c3, UBUNTU-CVE-2026-114043.