FreeRDP clients prior to version 3.32.1 have a heap-based out‑of‑bounds read in the WinPR clipboard handler. When a malicious Remote Desktop Protocol server transmits a specially crafted low‑bit‑depth PNG image in the clipboard stream, the client’s bitmap writing routine copies more data than the buffer holds, exposing large portions of the client’s heap memory to the attacker. The primary consequence is the disclosure of sensitive data that resides on the heap, potentially including credentials, session keys, or other confidential information. This vulnerability does not enable arbitrary code execution but raises a significant confidentiality risk.

The affected product is FreeRDP (FreeRDP:FreeRDP). Any client build before 3.32.1 includes the flaw. All users running these older versions of FreeRDP are at risk, regardless of platform. No additional enterprise products were identified.

The CVSS score of 7.1 indicates high severity, while the EPSS score is below 1%, suggesting limited exploitation activity to date. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker who can control the RDP server and send clipboard data to the victim; the attacker must establish a Remote Desktop session to trigger the flaw. Once exploited, the attacker can read arbitrary heap memory, potentially compromising confidentiality of data that the client holds at the time of the clipboard paste operation.