CVE-2026-67305

EUVD-2026-51862

01.08.2026, 13:17

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	9.4 CRITICAL	NETWORK	LOW	NONE	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
freerdp	freerdp	𝑥 < 3.29.0	CNA

Debian Releases

Debian Product

Codename

freerdp2

bookworm	2.11.7+dfsg1-6~deb12u1 fixed
bullseye	2.3.0+dfsg1-2+deb11u1 fixed
bullseye (security)	2.3.0+dfsg1-2+deb11u3 fixed

freerdp3

forky	3.30.0+dfsg-1 fixed
sid	3.30.0+dfsg-1 fixed
trixie	3.15.0+dfsg-2.1+deb13u3 fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr

https://www.vulncheck.com/advisories/freerdp-windows-client-before-heap-buffer-overflow-via-cliprdr