FreeRDP CVE-2026-109248

Exploitation requires the victim to (1) initiate an RDP connection to an attacker-controlled or compromised server, (2) have clipboard/file redirection enabled so CB_FORMAT_DATA_RESPONSE file-descriptor data is processed, and (3) actively PASTE the server-copied files on the client side - the UI:A metric makes this user paste action a hard prerequisite. Affected builds are FreeRDP 3.0.0 through 3.31.x (fixed in 3.32.0) on X11, Wayland, and SDL clients. Limiting factors: the attacker must control the server the victim connects to (clients are not passively reachable), clipboard file redirection must be active, and the maximum impact is a client crash - there is no code execution or data exposure per the provided vector.

This is a medium-severity, availability-only client-side vulnerability whose real-world risk is moderate and heavily gated by user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H) is internally consistent with the description: the attack is network-reachable and low-complexity, requires no authentication to the malicious server, but depends on active user interaction (the victim must paste server-copied files) and yields only an availability impact (VA:H) - a client crash - with no confidentiality or integrity loss (VC:N/VI:N). Notably this is a REVERSE attack: a malicious or compromised RDP server attacks the connecting client, not the usual client-to-server direction, which narrows the realistic threat population to users who are lured into connecting to attacker-controlled servers. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only outcome is a denial of service (crash) of X11/Wayland/SDL clients. One tension to verify: the input Tags include 'Information Disclosure,' but the CVSS 4.0 vector assigns VC:N (no confidentiality impact) and the described outcome is a crash - an out-of-bounds READ (CWE-125) can in principle leak memory, but the authoritative vector treats this as availability-only, so the 'Information Disclosure' label should not be taken as confirmed. Overall: a legitimate bug to patch, but not a top-priority emergency absent the user-paste precondition.

A user connects their FreeRDP-based client (e.g., a Linux remote desktop tool) to a malicious or compromised RDP server with clipboard/file redirection enabled. The server sends a crafted CB_FORMAT_DATA_RESPONSE containing an odd-length FILEDESCRIPTORW blob with a non-NUL-terminated cFileName; when the user pastes the server-copied files, WinPR's convert_filedescriptors_to_file_list() scans past the buffer, triggering a heap out-of-bounds read that crashes the client. No public exploit code was identified at time of analysis.