FreeRDP EUVD-2026-102557

Exploitation requires the victim to run the FreeRDP Windows client (versions 3.30.0 up to but not including 3.32.0) and connect to an attacker-controlled or compromised RDP server. The specific trigger is clipboard file-transfer (cliprdr): the user must actively paste a remote file, which causes the client to issue a FILECONTENTS_SIZE request that the malicious server answers with a cbRequested value under eight bytes. Limiting factors are significant: the attacker must control the server side (not the typical client-attacks-server RDP model), the user must both initiate the connection and perform the paste action (UI:P), the clipboard redirection/file-transfer feature must be in use, and attack complexity is high (AC:H/AT:P). Impact is confined to a client crash or limited memory over-read.

This is a low-severity issue by every available signal and should not be treated as a priority patch under normal circumstances. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L) yields a base score of 2.3, driven down by high attack complexity (AC:H), a present attack requirement (AT:P - the victim must paste a remote file), required user interaction (UI:P), and only Low impact to confidentiality, integrity, and availability. The vulnerability is a heap out-of-bounds READ (CWE-125), so the realistic worst case is a client crash or limited adjacent-memory disclosure, not code execution. No EPSS score was provided (exploitation probability cannot be quantified from this data), the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The attack model is also inverted from typical RDP risk: the malicious party is the SERVER and the victim is the connecting CLIENT, meaning a user must be lured into connecting to an attacker-controlled or compromised RDP host and then actively paste a remote file. There are no conflicting signals here; all evidence consistently points to a genuinely low real-world risk rather than a high-CVSS-but-low-real-risk mismatch.

A user is lured into connecting their FreeRDP Windows client to a malicious or compromised RDP server. When the user pastes a file from the remote clipboard, the server answers the client's FILECONTENTS_SIZE request with a cbRequested value of fewer than eight bytes, triggering a heap out-of-bounds read in CliprdrStream_New that crashes the client or corrupts the stream size. No public exploit code is identified at time of analysis, and high attack complexity plus required user interaction make opportunistic exploitation unlikely.