CVE-2026-67305CWE-122

CVE-2026-67305

High · published August 1, 2026

CVSS v3.1

8.8

EPSS

Percentile

55.1

In the wild

Unconfirmed

What it is

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00768 · 55.1th percentile
Weakness: CWE-122 · Heap-based Buffer Overflow
Published: 2026-08-01T17:17Z

Affected products (1)

Product	Versions	Fixed in
freerdp/freerdp	< 3.29.0	3.29.0

References (3)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr · [email protected]https://www.vulncheck.com/advisories/freerdp-windows-client-before-heap-buffer-overflow-via-cliprdr · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

01 AUG 12:22Z
FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
cvelistv5