CVE-2026-111376 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical security flaw within the Windows client implementation, specifically located in the CliprdrStream_New function responsible for handling clipboard redirection streams. This heap-based out-of-bounds read vulnerability arises from insufficient validation of input data received during file transfer operations over Remote Desktop Protocol connections. The core technical issue stems from the application's failure to adequately verify the length and structure of incoming clipboard responses before processing them, allowing a malicious RDP server to exploit this logic gap by sending malformed or truncated data packets that do not meet expected structural requirements for safe memory access.
From an operational perspective, this flaw is triggered when a user initiates a paste operation involving files from the remote session into their local environment. During this process, the client sends a FILECONTENTS_SIZE request to determine the size of the file content being transferred. A malicious server can respond with a cbRequested field containing fewer than eight bytes, which violates the minimum expected payload size for valid clipboard data structures. Because the application does not perform rigorous bounds checking on this specific parameter before attempting to read from or allocate memory based on it, the client attempts to access memory locations outside the allocated heap buffer boundaries. This results in an invalid memory read operation that can lead to immediate application crashes due to segmentation faults or more insidious outcomes such as information disclosure if sensitive data residing adjacent to the vulnerable buffer is leaked into the attacker-controlled stream.
The security implications of this vulnerability are significant, particularly given the interactive nature of Remote Desktop Protocol usage where users frequently exchange files between local and remote environments. An attacker controlling a malicious RDP server can exploit this weakness without requiring any special privileges on the target system beyond establishing a connection. The potential for denial-of-service is high due to the guaranteed crash condition when short responses are provided, while the risk of arbitrary code execution remains elevated if an attacker can leverage memory corruption patterns associated with out-of-bounds reads in conjunction with other heap exploitation techniques. This aligns closely with CWE-125, which defines Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of a buffer, and falls under MITRE ATT&CK technique T1046 Network Service Scanning if used for reconnaissance, though primarily it serves as an initial vector for further exploitation in this context.
To mitigate this risk, organizations deploying FreeRDP must ensure that all client instances are updated to version 3.32.0 or later where the input validation logic has been corrected to enforce strict length checks on clipboard stream data before processing. Administrators should also consider implementing network-level authentication and restricting RDP access to trusted networks only to reduce the attack surface exposed to untrusted servers. Additionally, deploying intrusion detection systems capable of identifying anomalous clipboard traffic patterns or malformed protocol packets can provide an additional layer of defense against exploitation attempts targeting this specific vulnerability in legacy environments that cannot be immediately patched.