Which versions of FreeRDP are affected by EUVD-2026-51862?

FreeRDP Windows client (versions before 3.29.0) contains a critical remote code execution vulnerability (CVSS 9.4) triggered by malicious RDP server connections; no public exploit code has been…. A patch is available.

How to fix or mitigate EUVD-2026-51862?

Within 24 hours, identify all systems running FreeRDP Windows client and prioritize those with access to sensitive data or networks; verify the current installed version. Within 7 days, begin deploying FreeRDP 3.29.0 to all affected endpoints, starting with high-risk systems and users requiring remote access to critical infrastructure. Within 30 days, complete deployment to all systems and audit for successful patching; implement network-level restrictions to limit RDP connections to trusted servers only.

FreeRDP EUVD-2026-51862

Q: What is the CVSS score of EUVD-2026-51862?

EUVD-2026-51862 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-67305 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-08-01 VulnCheck

GHSA-3w26-2cxg-pvh3

Buffer Overflow RCE Microsoft Heap Overflow Freerdp

9.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Server-to-client attack over the network with low complexity but requiring the victim's paste action (UI:R); no prior privileges (PR:N); memory corruption yields full C/I/A impact within the client process (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 13:03 vuln.today

Patch available

Aug 01, 2026 - 13:01 EUVD

CVE Published

Aug 01, 2026 - 12:22 cve.org

CRITICAL 9.4

DescriptionCVE.org

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.

AnalysisAI

Heap-based remote code execution in the FreeRDP Windows client (all versions before 3.29.0) is triggered when a user pastes clipboard content sourced from a malicious RDP server. The client fails to validate the server-supplied data size in CLIPRDR_FILE_CONTENTS_RESPONSE PDUs against the destination buffer, allowing an oversized payload to corrupt heap memory. A publicly available vendor advisory (GHSA-cj9v-h4hq-29jr, reported by VulnCheck) documents the flaw; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in the CLIPRDR (Clipboard Virtual Channel Extension) subsystem of RDP, which synchronizes clipboard state between an RDP client and server. When a user requests file-content data from the remote clipboard (e.g., during a paste of a copied file), the server replies with a CLIPRDR_FILE_CONTENTS_RESPONSE PDU carrying the requested bytes. FreeRDP's Windows client copies this server-controlled payload into a fixed/pre-sized heap buffer without checking that the returned length matches or fits the amount originally requested. This is a classic CWE-122 heap-based buffer overflow: attacker-controlled length + missing bounds check + memcpy-style copy into an undersized allocation, corrupting adjacent heap metadata and chunks. The affected component is the FreeRDP library (cpe:2.3:a:freerdp:freerdp), specifically the Windows client build path, and the trust boundary is inverted from the usual RDP model - here the SERVER attacks the CLIENT.

RemediationAI

Vendor-released patch: upgrade to FreeRDP 3.29.0 or later, which adds validation of the server-provided size against the destination buffer for CLIPRDR_FILE_CONTENTS_RESPONSE handling. Downstream products that bundle FreeRDP must rebuild against the patched library. Where immediate patching is not possible, the primary compensating control is to disable clipboard redirection / the cliprdr virtual channel in client configuration (trade-off: users lose copy-paste of files and text between local and remote sessions); additionally restrict outbound RDP connections to trusted, known-good servers only and block users from opening untrusted .rdp files or connecting through unvetted RDP gateways (trade-off: reduced flexibility for ad-hoc remote connections). Apply the fix per the vendor advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr.