SECURITYCRITICALCVE-2026-68579

CVE-2026-68579: FreeRDP Heap Buffer Overflow in Windows Clipboard Client

A critical heap-based buffer overflow in FreeRDP's Windows clipboard client allows an OLE paste consumer to trigger memory corruption, scoring CVSS 9.6....

Dylan H.

Security Team

August 3, 2026
2 min read
CVE-2026-68579: FreeRDP Heap Buffer Overflow in Windows Clipboard Client

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • FreeRDP <= 3.29.0 (all platforms using the Windows clipboard client)

Overview

A critical heap-based buffer overflow vulnerability has been identified in FreeRDP, the popular open-source Remote Desktop Protocol (RDP) client. Tracked as CVE-2026-68579 with a CVSS score of 9.6 (Critical), the flaw exists in the Windows clipboard client's CliprdrStream_Read function located in client/Windows/wf_cliprdr.c.

All FreeRDP releases at or prior to 3.29.0 are affected. The vulnerability is patched in FreeRDP 3.30.0.

Technical Details

When an OLE paste consumer — such as explorer.exe — calls IStream::Read with a fixed-size buffer of cb bytes, the CliprdrStream_Read function requests more data than the buffer can hold. Specifically, the function may request m_lSize - m_lOffset bytes regardless of the caller-provided cb limit.

This mismatch between the allocated buffer size and the amount of data written creates a classic heap overflow condition. An attacker who can influence the clipboard data served over an RDP session can exploit this overflow to corrupt adjacent heap memory.

Attack Vector

  • Vector: Network (RDP session)
  • Privileges Required: Low (authenticated RDP session)
  • User Interaction: Required (victim must perform a paste operation)
  • Scope: Changed (host process memory can be corrupted)

The practical attack scenario involves a malicious RDP server crafting clipboard payloads that trigger oversized reads when the victim attempts to paste content in a Windows session.

Affected Versions

ProductAffected VersionsFixed Version
FreeRDPAll versions <= 3.29.03.30.0

Remediation

Upgrade to FreeRDP 3.30.0 or later as soon as possible. The fix constrains the read request within CliprdrStream_Read to the caller-supplied cb value, preventing oversized heap writes.

# Check current FreeRDP version
freerdp3 --version
 
# For package-manager installs, check your distribution's security advisories
apt list --installed | grep freerdp

If an immediate upgrade is not possible, consider disabling clipboard sharing in RDP sessions as a temporary mitigation:

# Disable clipboard redirection in xfreerdp
xfreerdp /v:target /clipboard:off

References