CVE-2026-111881
Description
A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol (RDP) session can exploit this by supplying a specially crafted bitmap image through clipboard data exchange. This flaw can cause the client application to crash, leading to a Denial of Service (DoS), or potentially result in an out-of-bounds memory write.
Statement
This flaw is triggered when a FreeRDP client processes crafted clipboard bitmap data from a malicious RDP peer, so User Interaction is Required. Availability is High due to a reliably demonstrated client crash from an integer underflow in the BMP writer. Confidentiality and Integrity are Low for a potential follow-on out-of-bounds write that was not shown to yield controlled corruption or code execution. Red Hat rates this Important (CVSS 7.6). ASLR, NX, and FORTIFY_SOURCE may further limit exploitation beyond denial of service, but they do not eliminate the crash, so Availability remains High.
Mitigation
Connect FreeRDP clients only to trusted remote peers and avoid accepting clipboard content from untrusted RDP sessions. If clipboard redirection is not needed, disable clipboard sharing in the FreeRDP client.
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable clipboard redirection in FreeRDP client sessions connecting to untrusted RDP peers to prevent WinPR BMP writer stride underflow during sub-byte image synthesis: upgrade to FreeRDP 3.32.0 (or the fixed Freerdp builds), which correct sub-byte stride calculation in the BMP writer to match four-byte alignment and prevent underflow before calling Stream_Zero, closing all 2 injection vectors (crafted 1-bpp bitmap returned via RDP clipboard channel, clipboard image synthesis for CF_DIB or CF_DIBV5 formats). Until patched, this is a concern on FreeRDP client hosts connecting to untrusted RDP peers with clipboard redirection enabled, so connect FreeRDP clients only to trusted remote peers and disable clipboard sharing or avoid requesting clipboard image data in CF_DIB or CF_DIBV5 formats from untrusted RDP sessions. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer underflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.6 | N/A | 7.6 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Instability
This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.
Integrity
Technical Impact: Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
