The flaw exists in the WinPR library’s image readers, lacking proper error handling when parsing PNG or JPEG data from the clipboard. When a malicious or compromised RDP server supplies a malformed PNG or truncated JPEG during a clipboard transfer, the FreeRDP client will abort or terminate, resulting in a denial of service.

All FreeRDP installations running any release prior to version 3.32.2 are affected. The issue is tied to the WinPR component and emerges only when clipboard image redirection is enabled.

The CVSS score of 8.7 categorizes the flaw as high severity, yet no EPSS score is reported and the vulnerability is not currently listed in the CISA KEV catalog. An attacker can remotely trigger the crash by sending crafted clipboard content over an RDP session, making a denial of service feasible from a remote source.