CVE-2026-109248
MEDIUMCVSS 6.5Description
FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.
Timeline
Published:October 12th, 2026 5:17 PM
Last modified:November 2nd, 2026 8:49 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Software
From NVD CPE configuration data
Vendors
freerdp
Products
freerdp
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp2r-gm4v-wvq2Exploit
- https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-out-of-bounds-read-via-winpr-clipboard-cfilenameThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp2r-gm4v-wvq2Exploit
Source: NIST NVD · Data may lag official sources by up to one minute