FreeRDP CVE-2026-44420

Requires (1) a FreeRDP-based server running a version prior to 3.26.0 with the cliprdr clipboard redirection virtual channel enabled (the default for most server builds), (2) network reachability to the RDP listening port (typically TCP 3389), and (3) low-privilege authenticated access sufficient to establish an RDP session and negotiate the clipboard channel - per CVSS PR:L, this is not pre-authentication. No user interaction on the server side is required (UI:N). Exploitation is limited to deployments that expose FreeRDP server-mode (not the more common client usage); pure client installs of xfreerdp are not in scope for this server-side bug.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity attack requiring only low privileges with no user interaction and full CIA impact - consistent with an authenticated RDP client triggering memory corruption against a server. PR:L is notable: an attacker must establish an RDP session before reaching the cliprdr channel, so this is not a pre-auth bug, which meaningfully limits exposure where RDP is gated by VPN, NLA, or strong credentials. No EPSS score, KEV listing, or SSVC decision data was provided, and the only reference is the GHSA advisory itself; there is no public exploit identified at time of analysis. The heap-overflow-write primitive is plausibly exploitable for RCE as the advisory notes, but no weaponization is documented, so realistic priority is high for internet-exposed FreeRDP servers and moderate for internal deployments behind authentication gateways.

An attacker with valid RDP credentials (or access to a compromised account) connects to a FreeRDP-based remote desktop server, completes session negotiation, and during clipboard channel setup sends a crafted CB_CLIP_CAPS PDU declaring a capabilitySetLength smaller than the actual data, triggering a heap write past the allocated buffer. The immediate result is a server crash causing denial of service to all connected users; with additional heap-grooming, the same primitive could plausibly be developed into remote code execution in the server process context. No public exploit identified at time of analysis.