CVE-2026-111376: FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the Windows FreeRDP client in versions 3.30.0 through before 3.32.0 are exposed when connecting to a malicious RDP server and pasting a remote file.
What must an attacker do to trigger the flaw?
The attacker must operate or control a malicious RDP server and respond to a FILECONTENTS_SIZE request with a cbRequested value smaller than eight bytes. Exploitation also requires user interaction: the user must paste a remote file.
What is the likely impact of successful exploitation?
A malicious server can cause invalid heap memory reads, which may crash the client or corrupt the stream size. The provided severity vector indicates low impacts to confidentiality, integrity, and availability.
Which versions should be remediated?
FreeRDP 3.30.0 through versions before 3.32.0 are affected. Upgrade to 3.32.0 or later.