Heap buffer overflow in FreeRDP Windows client clipboard virtual channel (CVE-2026-67305)

A heap buffer overflow exists in the FreeRDP Windows client (wfreerdp) when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs on the clipboard static virtual channel. A malicious RDP server can respond to a client file content request with a data payload larger than requested; the server-controlled size value (cbRequested) is used directly as the length parameter for CopyMemory() without bounds checking against the destination buffer, resulting in arbitrary heap memory corruption. Under favorable heap layout conditions this can lead to remote code execution, triggered when the victim connects to the malicious server with clipboard redirection enabled and performs a paste operation. Affected versions: - <= 3.28.0 We recommend updating to: 3.29.0. CVSS 9.4 · our assessment: act_now Reference: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr Details: https://vuln.today/cve/CVE-2026-67305