CVE-2026-67305

EUVD-2026-51862

01.08.2026, 13:17

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 44.21%

Affected Products (NVD)

Vendor	Product	Version
freerdp	freerdp	𝑥 < 3.29.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freerdp2

bookworm

2.11.7+dfsg1-6~deb12u1

fixed

freerdp3

forky	3.31.1+dfsg-1 fixed
sid	3.31.1+dfsg-1 fixed
trixie	3.15.0+dfsg-2.1+deb13u3 fixed

Ubuntu Releases

Ubuntu Product

Codename

freerdp

bionic	not-affected
jammy	dne
noble	dne
resolute	dne
xenial	not-affected

freerdp2

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	dne

freerdp3

jammy	dne
noble	not-affected
resolute	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr

https://www.vulncheck.com/advisories/freerdp-windows-client-before-heap-buffer-overflow-via-cliprdr

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr