CVE-2026-68579
FreeRDP: FreeRDP: Arbitrary Code Execution via Heap Overflow in Clipboard Processing
Severity by source
Trivy's own label is CRITICAL. Rated critical by Red Hat. Rated lower by Ubuntu (medium).
Description
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStream_Read requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (req_fsize) instead of cb. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | freerdp2 | no fix listed |
| debian 12 | freerdp2 | no fix listed |
| debian 13 | freerdp3 | no fix listed |
| debian 14 | freerdp3 | 3.30.0+dfsg-1 |
| echo | freerdp2, freerdp3 | no fix listed |
| rapidfort alpine 3.20 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.30.0-r0 |
| rapidfort debian 12 | freerdp2, freerdp3 | 0:3.30.0+dfsg-1 |
| rapidfort debian 13 | freerdp2, freerdp3 | 0:3.30.0+dfsg-1 |
Show all 23 entries from 15 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | freerdp2 | no fix listed |
| debian 12 | freerdp2 | no fix listed |
| debian 13 | freerdp3 | no fix listed |
| debian 14 | freerdp3 | 3.30.0+dfsg-1 |
| echo | freerdp2 | no fix listed |
| echo | freerdp3 | no fix listed |
| rapidfort alpine 3.20 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.21 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.22 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.23 | freerdp | 3.30.0-r0 |
| rapidfort alpine 3.24 | freerdp | 3.30.0-r0 |
| rapidfort debian 12 | freerdp2 | no fix listed |
| rapidfort debian 12 | freerdp3 | 0:3.30.0+dfsg-1 |
| rapidfort debian 13 | freerdp2 | no fix listed |
| rapidfort debian 13 | freerdp3 | 0:3.30.0+dfsg-1 |
| rapidfort fedora 43 | freerdp | 2:3.30.0-1.fc43 |
| rapidfort fedora 43 | freerdp-devel | 2:3.30.0-1.fc43 |
| rapidfort fedora 43 | freerdp-libs | 2:3.30.0-1.fc43 |
| rapidfort fedora 43 | freerdp-server | 2:3.30.0-1.fc43 |
| rapidfort fedora 43 | libwinpr | 2:3.30.0-1.fc43 |
| rapidfort fedora 43 | libwinpr-devel | 2:3.30.0-1.fc43 |
| ubuntu 24.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 |
| ubuntu 26.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 |
References
- https://access.redhat.com/security/cve/CVE-2026-68579
- https://github.com/FreeRDP/FreeRDP/commit/5e8e987b469b60a3bafadf8f5afc40f91c09f458
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m37j-jcr2-8gcc
- https://nvd.nist.gov/vuln/detail/CVE-2026-68579
- https://www.cve.org/CVERecord?id=CVE-2026-68579
- https://www.vulncheck.com/advisories/freerdp-before-heap-overflow-via-cliprdrstream-read