CVE-2026-67305 FreeRDP CVE debrief

Who should care

Users of FreeRDP Windows client before version 3.29.0, administrators of systems with FreeRDP installed, and security teams responsible for monitoring and patching vulnerabilities. These stakeholders should be aware of the critical nature of this vulnerability and take immediate action to patch or mitigate the vulnerability. Additionally, security teams should review their current vulnerability management processes to ensure that similar vulnerabilities are addressed promptly in the future.

Technical summary

The FreeRDP Windows client before version 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel. This vulnerability occurs when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can exploit this by sending a response with a data payload significantly larger than requested, leading to arbitrary heap memory corruption. This corruption may enable remote code execution when a user performs a paste operation.

Defensive priority

FreeRDP Windows client users should prioritize patching to prevent potential remote code execution via heap buffer overflow.

Recommended defensive actions

• Patch FreeRDP Windows client to version 3.29.0 or later
• Restrict access to RDP services until patching can be performed
• Monitor RDP traffic for suspicious activity
• Implement additional security controls, such as network segmentation and access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-67305 record indicates a heap buffer overflow vulnerability in FreeRDP Windows client before version 3.29.0. The vulnerability is in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation. Evidence is limited; further verification is recommended.

Official resources