SYS::ONLINE
Wasteland.
Briefs1665
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-68579 2026-08-02

FreeRDP Heap Overflow in Windows Clipboard Client (CVE-2026-68579)

"One flag: the editorial note I was given is truncated mid-sentence (`...scores, C`), so I can't tell what it asked for. I've revised under the conservative reading, that the CVSS 3.1 and 4.0 scores and vectors are…"

One flag: the editorial note I was given is truncated mid-sentence (...scores, C), so I can't tell what it asked for. I've revised under the conservative reading, that the CVSS 3.1 and 4.0 scores and vectors are verified and must be preserved verbatim, and left every other factual claim intact. If the note actually said those figures were unverified, send the full text and I'll redo it.

FreeRDP Heap Overflow in Windows Clipboard Client (CVE-2026-68579)

An out-of-bounds write in FreeRDP's Windows clipboard client lets a malicious or compromised RDP server corrupt heap memory on the connecting client when a user pastes server-offered file contents.

What Is It

CVE-2026-68579 is a heap-based buffer overflow (CWE-787) in the CliprdrStream_Read function of FreeRDP's Windows clipboard client (client/Windows/wf_cliprdr.c).

When an OLE paste consumer such as explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) rather than the caller's buffer size (cb). A malicious or compromised RDP server can answer with an oversized CB_FILECONTENTS_RESPONSE, writing attacker-controlled data out of bounds into the paste consumer's heap buffer.

The flaw was disclosed via VulnCheck and published to NVD on 2026-08-02.

Why It Matters

The trust direction is inverted here: the client is the victim. Anyone who can stand up or take over an RDP server, a rogue host, a hijacked jump box, a lured connection, can write past the end of a heap buffer in the process that consumes the paste, which on a typical Windows desktop is the user's own shell.

The two published severity ratings do not agree, and the gap is worth reading before acting on either number:

These describe materially different bugs. The 3.1 vector scores a scope change with high integrity impact; the reading that the corruption reaches a process outside the vulnerable component. The 4.0 vector explicitly denies that (SC:N/SI:N/SA:N) and rates the outcome as availability-only, i.e. a crash rather than a foothold. They also disagree on whether a user has to do anything (UI:R versus UI:N), which the code path itself suggests should be UI:R, since the overflow is reached through a paste.

Neither vector should be treated as an established finding about exploitability. Cross-process code execution is a plausible inference from the 3.1 scoring and from where the write lands, but it is an inference from a contested metric, not a demonstrated result; no public proof-of-concept or exploitation analysis accompanies the advisory. The conservative planning assumption is a client-side memory-corruption bug of at least crash severity, with escalation to integrity impact treated as possible and unconfirmed.

What's Vulnerable

FreeRDP versions before 3.30.0 (that is, 3.29.0 and earlier) are affected. The vendor default status for other versions is unaffected, and 3.30.0 is marked unaffected. The vulnerable code path is Windows-specific, in the clipboard redirection client.

Based on the described code path, exploitation appears to require user interaction, the overflow triggers on paste of server-offered clipboard file contents. Note that the CVSS 4.0 vector scores this as UI:N, so do not rely on "the user has to paste something" as a hard gate. The exposure that matters for scoping is not how many RDP servers you run, but how many Windows hosts run a FreeRDP-derived client and connect outward, including to servers you do not control.

Patch Status

Upgrade to FreeRDP 3.30.0 or later. The fix is in upstream commit 5e8e987b469b60a3bafadf8f5afc40f91c09f458, with details in GitHub Security Advisory GHSA-m37j-jcr2-8gcc.

Where patching lags, the code path suggests disabling clipboard redirection on outbound FreeRDP connections narrows the reachable surface, since the overflow is reached through clipboard file-contents transfer. Treat that as mitigation, not a fix.

No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or KEV-mandated remediation deadline on record at this time. NVD status is Received, meaning analysis is still pending; the conflicting vectors above may be reconciled once that analysis completes.

Sources