CVE-2026-110839

Executive Summary

CVE-2026-110839 is a heap-based out-of-bounds write (CWE-787) in FreeRDP versions 3.3.0 through 3.31.x when compiled with the WINPR_UTILS_IMAGE_JPEG=ON build option. A malicious or compromised RDP server can supply a crafted grayscale JPEG via clipboard redirection, causing the client's winpr_convert_from_jpeg routine to under-allocate an output buffer and subsequently write past its bounds when the clipboard item is pasted as CF_DIB bitmap data. With a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), exploitation requires user interaction (a paste action) but no privileges, resulting in a high-availability impact (client crash/memory corruption) and low-integrity impact, with no confidentiality impact.

Technical Analysis

FreeRDP is a widely used open-source implementation of the Remote Desktop Protocol (RDP), deployed both as a client (connecting to remote desktops) and embedded in other applications. The WinPR utility library provides cross-platform helper functionality, including image codec conversions used by the clipboard subsystem.

When FreeRDP is built with WINPR_UTILS_IMAGE_JPEG=ON, JPEG images received over RDP clipboard redirection are decoded through winpr_convert_from_jpeg. The NVD description states the core defect precisely: "grayscale JPEG buffers are sized from one input component rather than three BGR output components." A grayscale JPEG carries a single color component per pixel, whereas the conversion target is 3-component BGR. The buffer allocation logic therefore sizes the destination from one component while the conversion routine writes as though three components exist — a classic allocation/write-size mismatch resulting in a heap-based out-of-bounds write.

The attack surface is the RDP clipboard redirection channel. Clipboard redirection is a standard RDP feature that synchronizes the client and server clipboards. A malicious or attacker-controlled RDP server can publish clippings containing a grayscale JPEG. When the victim pastes that clipping on the client, the item is converted to CF_DIB bitmap data, at which point winpr_convert_from_jpeg is invoked and the under-sized heap buffer is overrun. The consequence is memory corruption and a client crash.

No specific line numbers, internal callers, or patch diff details are provided in the available data; the above reflects only what the NVD description states verbatim. No public PoC, exploit code, or Nuclei template is available.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (heap-based out-of-bounds write in a JPEG-to-BGR conversion path). No public PoC exists; specific code patterns are not fabricated.

1. Reconnaissance / target identification. The attacker identifies or controls an RDP server that a victim's FreeRDP client (built with WINPR_UTILS_IMAGE_JPEG=ON, versions 3.3.0–3.31.x) will connect to. This may be a legitimately operated but malicious host, a compromised server, or an attacker-controlled endpoint reachable by the victim under a social-engineering pretext.

2. Triggering the flaw class. During an established RDP session with clipboard redirection enabled, the malicious server places a crafted grayscale JPEG onto the shared clipboard. The crafted image is structured so that its single component causes the destination buffer for the 3-component BGR output to be under-allocated.

3. Payload / execution method. Because the item is a clipboard object, the write to the under-sized buffer is only exercised when the victim performs a paste on the client side, converting the clipping to CF_DIB bitmap data. This is what drives the user-interaction requirement (UI:R) in the CVSS vector: the victim must paste the malicious clipboard content.

4. Post-exploitation impact. The immediate effect is heap memory corruption and a client crash, matching the A:H (high availability impact) subscore. Where the corruption is attacker-controlled in size and placement, it could in principle affect adjacent heap structures, but the provided data supports only denial-of-service/crash as the demonstrated impact, with limited integrity impact (I:L) and no confidentiality impact (C:N).

Impact Assessment

• Business impact: A crafted clipboard item from a malicious RDP server can crash FreeRDP client sessions, causing denial of service for remote workers and disrupting RDP-dependent workflows. Repeated exploitation across a workforce is a viable low-effort disruption vector.
• Affected systems: FreeRDP 3.3.0 through 3.31.x builds compiled with WINPR_UTILS_IMAGE_JPEG=ON, particularly those using clipboard redirection. Environments relying on FreeRDP-based thin clients, VDI gateways, and embedded RDP integrations are in scope.
• Blast radius: Attack is network-reachable (AV:N), low complexity (AC:L), requires no privileges (PR:N), but requires user interaction (UI:R). Scope is unchanged (S:U); the impacted security objectives are availability (High) and integrity (Low), with confidentiality not affected.
• Overall severity: CVSS 3.1 base 7.1 (High). EPSS has not been scored by FIRST.org; no CISA KEV listing; no known in-the-wild exploitation reported in the supplied data.

Detection Guidance

Sigma Rule

title: FreeRDP Grayscale JPEG Clipboard OOB Write (CVE-2026-110839)
id: 9b1d7c2a-4e33-4f1a-b6d2-0a7c9e5f1108
status: experimental
description: Detects FreeRDP client crashes correlated with clipboard paste activity that may indicate exploitation of CVE-2026-110839.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110839
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: linux
detection:
  selection_process:
    Image|endswith: '/freerdp'
  selection_crash:
    EventID: 1
    Message|contains:
      - 'winpr_convert_from_jpeg'
      - 'heap-buffer-overflow'
      - 'Segmentation fault'
  condition: selection_process and selection_crash
falsepositives:
  - Unrelated FreeRDP client crashes during normal operation
level: high
tags:
  - attack.t1204
  - cve.2026.110839

YARA Rule

rule CVE_2026_110839_FreeRDP_JPEG_Grayscale_OOB
{
    meta:
        description = "Detects FreeRDP builds/artifacts associated with grayscale JPEG clipboard OOB write (CVE-2026-110839)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110839"
        date = "2026-01-01"
        cve = "CVE-2026-110839"

    strings:
        $fn1 = "winpr_convert_from_jpeg" ascii
        $fn2 = "WINPR_UTILS_IMAGE_JPEG" ascii
        $cf1 = "CF_DIB" ascii
        $ver1 = "3.3.0" ascii
        $ver2 = "3.32.0" ascii

    condition:
        uint16(0) == 0x5A4D or (any of ($fn*) and any of ($cf1, $ver*))
}

Suricata IDS Rule

alert tcp any any -> any 3389 (msg:"CVE-2026-110839 FreeRDP Clipboard Grayscale JPEG OOB Write Attempt"; flow:established,to_client; content:"|FF D8 FF|"; content:"cliprdr"; nocase; classtype:attempted-dos; reference:cve,2026-110839; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110839; sid:2026110839; rev:1;)

Elastic Detection

process where process.name == "freerdp" and
  process.command_line : "*clipboard*" and
  event.outcome == "failure"

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=WinEventLog)
| search ("freerdp" OR "winpr")
| search ("winpr_convert_from_jpeg" OR "heap-buffer-overflow" OR "CF_DIB" OR "Segmentation fault" OR "clipboard")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process, Message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-110839,">
  <rule id="110839" level="12">
    <decoded_as>syslog</decoded_as>
    <match>winpr_convert_from_jpeg|heap-buffer-overflow|CF_DIB|freerdp.*Segmentation fault</match>
    <description>CVE-2026-110839: Possible FreeRDP grayscale JPEG clipboard out-of-bounds write (memory corruption/crash)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_110839,memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable clipboard redirection on FreeRDP clients where business use permits (/clipboard disabled), eliminating the attack vector.
   • Rebuild FreeRDP with WINPR_UTILS_IMAGE_JPEG=OFF if JPEG clipboard handling is not required.
   • Restrict outbound RDP connections to trusted, allow-listed servers; treat untrusted RDP endpoints as hostile.
   • User awareness: avoid pasting clipboard content received from untrusted or unfamiliar RDP sessions.

2. Patch / upgrade steps

   • Upgrade FreeRDP to version 3.32.0 or later, which the NVD description identifies as the fixed release threshold.
   • Verify the build configuration after upgrading and confirm the effective version (freerdp --version).
   • Monitor the FreeRDP project channels for the formal advisory and any backports.

3. Long-term hardening

   • Track FreeRDP releases and apply updates promptly, prioritizing components that process untrusted clipboard or image data.
   • Adopt memory-safe decoding practices and fuzz clipboard/image codec paths in CI.
   • Enforce least privilege and session isolation for RDP client processes to limit the effect of memory-corruption crashes.
   • Maintain EDR/application logging for FreeRDP crashes to detect exploitation attempts.

References

• NVD — CVE-2026-110839: https://nvd.nist.gov/vuln/detail/CVE-2026-110839
• FreeRDP Project (source and release notes): https://github.com/FreeRDP/FreeRDP
• MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html

Note: No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-110839 in the supplied data. No CISA KEV listing and no public PoC/exploit code exist as of this report.