EUVD-2026-51989
GHSA-m4j8-6wj9-56fg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via RDP, low complexity, no attacker privileges needed, but user must paste to trigger; scope changes to paste consumer process; fully controlled OOB write enables RCE beyond crash.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.
AnalysisAI
Heap-based buffer overflow in FreeRDP's Windows clipboard client (versions ≤ 3.29.0) allows a malicious or compromised RDP server to write attacker-controlled data beyond the bounds of a paste consumer's heap allocation. The flaw in CliprdrStream_Read trusts the server-supplied response length (req_fsize) rather than the caller-supplied buffer bound (cb), so any OLE paste consumer such as explorer.exe that calls IStream::Read against server-offered clipboard file contents can have its heap corrupted. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and a fix is available in FreeRDP 3.30.0.
Technical ContextAI
FreeRDP (CPE: cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) is a widely-used open-source implementation of Microsoft's Remote Desktop Protocol. The affected code is in the Windows-specific clipboard redirection client at client/Windows/wf_cliprdr.c, which implements the CLIPRDR virtual channel for bidirectional clipboard sharing. When a Windows OLE paste consumer invokes IStream::Read with a fixed-size buffer of cb bytes, the CliprdrStream_Read function issues a CB_FILECONTENTS_REQUEST to the remote RDP server, then copies the server's CB_FILECONTENTS_RESPONSE payload into the caller's buffer using the server-supplied req_fsize rather than the caller-controlled cb bound. This is a classic CWE-787 Out-of-Bounds Write: the server, acting as an untrusted source, dictates the copy length into a fixed heap allocation it did not create, enabling arbitrary heap corruption with fully attacker-controlled bytes in the paste consumer's process. The flaw is confined to the Windows build and does not exist in Linux or macOS FreeRDP builds.
RemediationAI
Upgrade to FreeRDP 3.30.0 or later, which contains the upstream fix committed at https://github.com/FreeRDP/FreeRDP/commit/5e8e987b469b60a3bafadf8f5afc40f91c09f458 and disclosed via the security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m37j-jcr2-8gcc. If immediate patching is not feasible, disabling clipboard redirection eliminates the vulnerable code path entirely - remove the +clipboard flag from FreeRDP invocations or set RedirectClipboard=false in client configuration; the trade-off is complete loss of clipboard sharing between client and server for the duration. As an additional policy control, restrict FreeRDP users from connecting to untrusted or external RDP servers, since exploitation requires an adversary-controlled server endpoint. Do not rely on network-layer blocking alone, as the vulnerability triggers during an authenticated RDP session over the CLIPRDR virtual channel.
Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and
FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today