FreeRDP up to 3.28.x Windows Clipboard Client wf_cliprdr.c CliprdrStream_Read heap-based overflow

Summaryinfo

A vulnerability has been found in FreeRDP up to 3.28.x and classified as critical. Affected by this issue is the function CliprdrStream_Read of the file client/Windows/wf_cliprdr.c of the component Windows Clipboard Client. Performing a manipulation results in heap-based overflow. This vulnerability was named CVE-2026-68579. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in FreeRDP up to 3.28.x. This affects the function CliprdrStream_Read of the file client/Windows/wf_cliprdr.c of the component Windows Clipboard Client. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-68579 since 07/31/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 3.30.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51989). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion