Executive brief
FreeRDP is a popular open-source RDP client used to remotely access Windows systems. When a user pastes clipboard file contents from an RDP server, a flaw in the Windows clipboard handler allows a malicious or compromised RDP server to write excessive amounts of data into the RDP client's memory. This can crash the client or lead to remote code execution, affecting any system using FreeRDP to connect to untrusted networks.
Technical details
This is a heap-based buffer overflow (CWE-787) in FreeRDP's Windows clipboard implementation, specifically in the CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g., explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server via a bounded CB_FILECONTENTS_RANGE request. However, the function copies the server's response into the caller's buffer using the server-supplied length (req_fsize) instead of respecting the caller's buffer size (cb), enabling a malicious server to return an oversized CB_FILECONTENTS_RESPONSE and overflow the buffer. The attack is triggered when a user pastes server-offered clipboard file contents, requiring no authentication beyond an established RDP connection. A successful exploit results in attacker-controlled data written to heap memory in the paste consumer process, leading to denial of service or arbitrary code execution.
Affected products
- FreeRDP FreeRDP <= 3.29.0
Timeline
- 2026-07-20: disclosed: GHSA advisory published
- 2026-08-02: disclosed: NVD entry published as CVE-2026-68579
- 2026: patched: Fixed in FreeRDP 3.30.0