FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback. The bug is triggered when a realloc failure occurs; a malicious RDP clipboard peer can supply a large CF_DIB image that causes an out‑of‑bounds memcpy during PNG conversion, ultimately crashing the client. The primary impact is a denial of service, as the vulnerable client will terminate when presented with such an image. The code flaw maps to CWE‑122 Heap Buffer Overflow and CWE‑787 Out‑of‑Bounds Write.

The affected product is the FreeRDP client suite, versions 3.10.0 through 3.32.2, used on both Windows and Linux platforms. Any system running these versions and accepting RDP clipboard data is susceptible.

The CVSS score of 6 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog, implying it is not widely exploited by known actors. EPSS score is less than 1%, indicating a very low but non-zero likelihood of exploitation. Exploitation requires an attacker who can supply a clipboard image during an RDP session; the attack vector is therefore remote, relying on the RDP clipboard feature. Because the flaw leads only to a crash, the risk is primarily a denial‑of‑service attack rather than a code execution vector.