FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that
    writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB
    image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash. (CVE-2026-109256)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that     writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB     image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash. (CVE-2026-109256)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478131	Alpine: multiple freerdp packages: security update to 3.32.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
478131	Alpine: multiple freerdp packages: security update to 3.32.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
371842	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3307)	Nessus	Amazon Linux Local Security Checks	Local	high
369227	Linux Distros Unpatched Vulnerability : CVE-2026-109256	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-109256

medium

Tenable Plugins

medium

medium

high

medium