CVE-2026-67305

FreeRDP's Windows client before 3.29.0 contains a heap-based buffer overflow (CWE-122) in the clipboard virtual channel, where a CLIPRDR_FILE_CONTENTS_RESPONSE PDU is processed without validating the server-provided size against the destination buffer. The flaw is triggered when a user connects to a malicious or compromised RDP server and then performs a paste operation, at which point the server sends a data payload significantly larger than the client requested. The resulting heap memory corruption can allow the attacker to achieve remote code execution on the user's Windows workstation. Anyone running an affected FreeRDP Windows client version who connects to RDP servers they do not fully trust is exposed, since the CVSS 4.0 vector reflects network reachability with user interaction (the paste) but no privileges. Exploitation has not been reported in the wild; one public proof-of-concept advisory exists and EPSS currently assigns a low 0.5% probability of exploitation in the next 30 days.

What to do: Upgrade the FreeRDP Windows client to version 3.29.0 or later, which fixes the missing size validation in the clipboard virtual channel. Until patched, instruct users to avoid paste operations when connected to untrusted or potentially compromised RDP servers, and inventory endpoints for FreeRDP client installations to confirm they are on a fixed version.