FreeRDP versions 3.3.0 through before 3.32.0 contain a heap-based out-of-bounds write in the JPEG conversion routine. The flaw occurs when processing a grayscale JPEG clipboard image because the output buffer is allocated for three BGR components while the input buffer provides only one. A malicious RDP server can transmit such an image, corrupting the client’s heap and causing a crash or denial of service when the clipboard content is pasted as a bitmap.

FreeRDP, versions 3.3.0 to 3.31.x built with the WINPR_UTILS_IMAGE_JPEG flag enabled. The vulnerability affects the client component that handles clipboard redirection.

The vulnerability has a CVSS score of 7.1. EPSS data is unavailable, and it is not listed in CISA’s KEV catalogue. An attacker who controls the RDP server can send a crafted grayscale JPEG via clipboard redirection, triggering the out‑of‑bounds write and crashing the client. The attack requires network access to the vulnerable client and an RDP session; it does not rely on local privilege escalation. Because the flaw is client-side memory corruption, the primary impact is a crash or service interruption rather than arbitrary code execution.