CVE-2026-109248: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName

Q: Which clients are affected in practice?

The issue can crash FreeRDP clients using X11, Wayland, or SDL when they process a malicious clipboard file descriptor from an RDP server.

Q: What must an attacker control or induce to trigger the crash?

An attacker needs to operate or control an RDP server that sends a specially crafted, odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE. The user must paste files that were copied from that server.

Q: Are clients exposed merely by connecting to an untrusted RDP server?

The provided information identifies the trigger as pasting server-copied files. It does not indicate that connection alone triggers the issue.

Q: What versions should be remediated?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected. Updating to 3.32.0 or later addresses the affected version range.

Published Oct 12, 2026

Updated

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr() and countspecialchars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CBFORMATDATARESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which clients are affected in practice?

The issue can crash FreeRDP clients using X11, Wayland, or SDL when they process a malicious clipboard file descriptor from an RDP server.

What must an attacker control or induce to trigger the crash?

An attacker needs to operate or control an RDP server that sends a specially crafted, odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE. The user must paste files that were copied from that server.

Are clients exposed merely by connecting to an untrusted RDP server?

The provided information identifies the trigger as pasting server-copied files. It does not indicate that connection alone triggers the issue.

What versions should be remediated?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected. Updating to 3.32.0 or later addresses the affected version range.

CVE-2026-109248: FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName

Affected Software

Event History

Frequently Asked Questions

Which clients are affected in practice?

What must an attacker control or induce to trigger the crash?

Are clients exposed merely by connecting to an untrusted RDP server?

What versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which clients are affected in practice?

What must an attacker control or induce to trigger the crash?

Are clients exposed merely by connecting to an untrusted RDP server?

What versions should be remediated?