CVE-2026-109248: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr() and countspecialchars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CBFORMATDATARESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which clients are affected in practice?
The issue can crash FreeRDP clients using X11, Wayland, or SDL when they process a malicious clipboard file descriptor from an RDP server.
What must an attacker control or induce to trigger the crash?
An attacker needs to operate or control an RDP server that sends a specially crafted, odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE. The user must paste files that were copied from that server.
Are clients exposed merely by connecting to an untrusted RDP server?
The provided information identifies the trigger as pasting server-copied files. It does not indicate that connection alone triggers the issue.
What versions should be remediated?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected. Updating to 3.32.0 or later addresses the affected version range.