CVE-2026-44420

HIGH8.8

FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS

Published May 29, 2026

Modified 2 days ago

Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

References

WEB

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3p3r

DETECTION

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-44420

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector