CVE-2026-111881 is a high severity (CVSS 7.6) integer underflow in the WinPR BMP writer of FreeRDP from 3.14.1 before 3.32.0. A malicious RDP clipboard peer can crash a client or cause an out-of-bounds write. Upgrade to 3.32.0. The sections below cover affected versions, how to check, and what to do first.
What's affected
FreeRDP 3.14.1 and later before 3.32.0. The GitHub advisory lists affected versions as 3.14.1 and above and the patched version as 3.32.0, matching the record.
The path is the clipboard. The advisory says a remote peer can advertise an image format and return crafted BMP data. The local side converts it when an application asks for the DIB clipboard formats, and the writer's stride math does not match the parser's. The record says the result is a crash or an out-of-bounds write.
Scoring note: the record's 7.6 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.2 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check your FreeRDP version:
xfreerdp /version
If you use a packaged client, query the package manager. Also check applications that bundle FreeRDP, such as remote desktop tools and gateways.
Then ask whether clipboard redirection is on for sessions to servers you do not fully control. If clipboard redirection is off, the described path is not reachable.
What to do now
- Inventory FreeRDP clients and software that embeds the library.
- Upgrade to 3.32.0 or a distribution build that carries the fix.
- Turn off clipboard redirection for sessions to untrusted servers.
- Connect only to RDP hosts you trust until clients are updated.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-191, integer underflow. The writer computes a row size one way and the parser computes it another way. For a tiny one bit image the difference becomes a negative number, which wraps to a huge unsigned value and is passed to a memory fill. The advisory says that value is SIZE_MAX minus 3.
It is an example of two pieces of code that disagree about the same quantity. The attacker in this case is the remote server, not the client user, which flips the usual trust direction of remote desktop. It is not listed in CISA KEV.
Quick check
Who is the attacker?
A malicious RDP peer, such as a rogue server that a client connects to.
Does turning off clipboard sharing help?
The advisory describes a clipboard path, so disabling it removes that route. Upgrading is the real fix.
Sources
Last reviewed: 18 October 2026.
