CVE-2026-67305: FreeRDP Windows Client Clipboard Heap Buffer Overflow, CVSS 9.4

FreeRDP Windows client (wfreerdp) disclosed CVE-2026-67305 heap buffer overflow, CVSS v4.0 9.4. Clipboard virtual channel fails to validate server-returned size when handling CLIPRDR_FILE_CONTENTS_RESPONSE PDU. A malicious RDP server can trigger heap corruption on paste, yielding RCE as the client process. Affects 3.28.0 and earlier; fixed in 3.29.0.

On 1 August 2026, the FreeRDP project disclosed a heap buffer overflow in the Windows client (`wfreerdp.exe`), tracked as CVE-2026-67305, CVSS v4.0 9.4 (Critical). The flaw sits in the Clipboard Virtual Channel path that handles the `CLIPRDR_FILE_CONTENTS_RESPONSE` PDU. Missing bounds checks on the server-returned data size let a malicious RDP server trigger arbitrary heap corruption when the user pastes (Ctrl+V), yielding remote code execution as the FreeRDP client process. Reported by researcher hyperlyz; FreeRDP shipped 3.29.0 the same day.

1. Incident Overview

FreeRDP is a widely used open-source RDP (Remote Desktop Protocol) implementation, common for Linux desktops connecting to Windows jump hosts, ops bastions, and remote support. The Windows `wfreerdp` client enables Clipboard Redirection by default, so copy/paste in the remote desktop window moves clipboard data over a virtual channel between client and server. The bug is in that channel's Windows client parse logic.

• CVE: CVE-2026-67305 (GitHub Advisory: GHSA-cj9v-h4hq-29jr)
• CVSS: v3.1 9.8 / v4.0 9.4 (Critical)
• Affected: FreeRDP Windows client (all <= 3.28.0)
• Fixed: FreeRDP 3.29.0
• Disclosure: 2026-08-01 / Attack prerequisite: clipboard redirection enabled by default + user paste

2. Technical Details

Classified as CWE-122 Heap-based Buffer Overflow. Root cause: a server-controlled length is passed straight to `CopyMemory()` without comparing against the destination buffer size. The path spans three functions:

• `cliprdr_read_file_contents_response()` (`cliprdr_common.c:384`) parses the `CLIPRDR_FILE_CONTENTS_RESPONSE` PDU from the server;
• `wf_cliprdr_server_file_contents_response()` (`wf_cliprdr.c:2449`) maps it into Windows client logic;
• `CliprdrStream_Read()` (`wf_cliprdr.c:249`) performs the final copy.

When the client requests cb bytes of file content, a malicious server returns a PDU with `dataLen` far larger than cb: the parser computes `cbRequested = dataLen - 4` with no upper bound and assigns it to `clipboard->req_fsize`; then `CliprdrStream_Read()` calls `CopyMemory(pv, req_fdata, req_fsize)`, writing up to 65,536 bytes into a buffer allocated for only cb (e.g. 16,384 bytes), an out-of-bounds heap write of about 49,152 bytes.

Exploit requires:

• Victim has clipboard redirection on (default) and connects to an attacker-controlled RDP server;
• Server sends `CB_MONITOR_READY` and `FORMAT_LIST` PDUs advertising `CF_HDROP` file-drop format;
• User pastes in Windows Explorer (Ctrl+V);
• Client requests cb bytes of file content as expected; malicious server returns `dataLen = OVERFLOW_SIZE + 4`, triggering the heap overflow;
• Crafted heap layout corrupts an adjacent `IStream` vtable pointer; on OLE `Release/Read/Stat`, control flow hijacks to attacker-controlled shellcode.

3. Impact Assessment

CVSS v4.0 vector `AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` — only `UI:P` (user must paste) limits the bar; all other dimensions are worst-case. Once RCE is achieved, code runs as the FreeRDP client process:

• Access local user files and session resources;
• Steal credentials and access tokens cached by the RDP client;
• Pivot into the enterprise via the client's existing VPN or trust channels;
• Bypass MFA in multi-factor setups (MFA typically guards the initial connect, not client behavior on an established channel).

Given RDP clients are common in remote support, ops jump hosts, and remote development — high-privilege contexts — real-world impact often exceeds the CVSS score.

4. Remediation

4.1 Immediate Fix

• Upgrade FreeRDP to 3.29.0 or later. Update Linux/macOS `xfreerdp` and Windows `wfreerdp` together.
• If installed via distro packages, watch upstream backport status; pull 3.29.0 binaries from FreeRDP official sources if needed.

4.2 Temporary Mitigation (when upgrade is not immediate)

• Disable clipboard redirection on the RDP command line: switch `+clipboard` to `-clipboard` (e.g. `xfreerdp -clipboard /v:host /u:user /p:pass`), cutting the attack surface;
• Whitelist jump/bastion hosts so they only connect to trusted RDP servers;
• Use EDR to watch `wfreerdp.exe` for anomalous child process creation and suspicious allocations;
• Warn users: do not paste when connected to unknown or untrusted RDP servers.

4.3 Hardening

• Routine FreeRDP version checks; patch within 72 hours of official security releases;
• Add second-factor auth and session recording on RDP jump hosts for post-incident audit;
• Watch further FreeRDP advisories. On 2 August another disclosure, CVE-2026-68579 (CliprdrStream_Read heap overflow) affecting <= 3.29.0; track 3.30.0 directly.

5. References

• FreeRDP GitHub Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67305
• Tenable: https://www.tenable.com/cve/CVE-2026-67305
• VulnCheck analysis: https://www.vulncheck.com/advisories/freerdp-windows-client-before-heap-buffer-overflow-via-cliprdr