CVE-2026-68579: FreeRDP Heap Buffer Overflow in Windows Clipboard Client

Overview

A critical heap-based buffer overflow vulnerability has been identified in FreeRDP, the popular open-source Remote Desktop Protocol (RDP) client. Tracked as CVE-2026-68579 with a CVSS score of 9.6 (Critical), the flaw exists in the Windows clipboard client's CliprdrStream_Read function located in client/Windows/wf_cliprdr.c.

All FreeRDP releases at or prior to 3.29.0 are affected. The vulnerability is patched in FreeRDP 3.30.0.

Technical Details

When an OLE paste consumer — such as explorer.exe — calls IStream::Read with a fixed-size buffer of cb bytes, the CliprdrStream_Read function requests more data than the buffer can hold. Specifically, the function may request m_lSize - m_lOffset bytes regardless of the caller-provided cb limit.

This mismatch between the allocated buffer size and the amount of data written creates a classic heap overflow condition. An attacker who can influence the clipboard data served over an RDP session can exploit this overflow to corrupt adjacent heap memory.

Attack Vector

• Vector: Network (RDP session)
• Privileges Required: Low (authenticated RDP session)
• User Interaction: Required (victim must perform a paste operation)
• Scope: Changed (host process memory can be corrupted)

The practical attack scenario involves a malicious RDP server crafting clipboard payloads that trigger oversized reads when the victim attempts to paste content in a Windows session.

Affected Versions

Remediation

Upgrade to FreeRDP 3.30.0 or later as soon as possible. The fix constrains the read request within CliprdrStream_Read to the caller-supplied cb value, preventing oversized heap writes.

# Check current FreeRDP version
freerdp3 --version
 
# For package-manager installs, check your distribution's security advisories
apt list --installed | grep freerdp

If an immediate upgrade is not possible, consider disabling clipboard sharing in RDP sessions as a temporary mitigation:

# Disable clipboard redirection in xfreerdp
xfreerdp /v:target /clipboard:off

References

• NVD Advisory: CVE-2026-68579
• FreeRDP GitHub Repository
• FreeRDP 3.30.0 Release Notes