Vulnerability · Published Aug 2, 2026 · Assigned by VulnCheck
CVE-2026-68579FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
Critical 9.6
In plain English
A critical-severity out-of-bounds write in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-68579 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-68579 |
| Debian:14 | freerdp3 | 3.30.0+dfsg-1 | DEBIAN-CVE-2026-68579 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-68579 |
| Ubuntu:24.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-68579 |
| Ubuntu:26.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-68579 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H
References
- GitHub Security Advisory (GHSA-m37j-jcr2-8gcc) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read third-party-advisory