FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers

Summary

FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.

Remediation

1. Inventory every FreeRDP FreeRDP deployment, including staging.
2. Upgrade FreeRDP FreeRDP to 3.32.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-799q-hjgw-g55g
• Advisoryhttps://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-winpr-png-jpeg-image-readers