CVE-2026-111376 Overview
FreeRDP versions 3.30.0 through 3.31.x contain a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New clipboard handler. A malicious Remote Desktop Protocol (RDP) server can respond to a FILECONTENTS_SIZE request with a cbRequested value smaller than eight bytes when a user pastes a remote file. The undersized response triggers an invalid memory read that crashes the client or corrupts the stream size value. Exploitation requires user interaction and a connection to an attacker-controlled server. The vulnerability is tracked under CWE-125 and is fixed in FreeRDP 3.32.0.
Critical Impact
A malicious RDP server can read beyond allocated heap memory when a connected Windows FreeRDP client pastes a remote clipboard file, resulting in client crashes or stream corruption.
Affected Products
- FreeRDP 3.30.0 (Windows client)
- FreeRDP 3.31.x (Windows client)
- FreeRDP versions prior to 3.32.0
Discovery Timeline
- 2026-10-16 - CVE-2026-111376 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-111376
Vulnerability Analysis
The flaw resides in the clipboard redirection subsystem of the FreeRDP Windows client. The CliprdrStream_New routine processes CLIPRDR_FILECONTENTS_RESPONSE packets returned by the RDP server when a user initiates a paste operation involving remote files. The handler assumes the server returns at least eight bytes to encode a 64-bit file size value. When a server supplies a cbRequested field smaller than eight bytes, the client reads past the end of the allocated buffer. This produces either a client crash through access violation or silent corruption of the stream's size field with attacker-influenced memory contents.
Root Cause
The root cause is missing length validation on server-supplied clipboard payloads. The code dereferences a 64-bit value from the response buffer without first confirming the buffer contains at least eight bytes. This matches the CWE-125 out-of-bounds read pattern, where a size assumption is encoded in logic rather than enforced through runtime checks.
Attack Vector
The attack requires a victim to connect a FreeRDP Windows client to a malicious or compromised RDP server. The user must then paste a remote file into the local system, which triggers a FILECONTENTS_SIZE request. The attacker-controlled server replies with a truncated response that causes the client to read uninitialized or adjacent heap memory. The vulnerability does not permit remote code execution, but it provides a reliable crash primitive and may surface small amounts of adjacent heap data into the clipboard stream. See the GitHub Security Advisory GHSA-pvgq-84w2-93ph and the VulnCheck Advisory for additional protocol details.
Detection Methods for CVE-2026-111376
Indicators of Compromise
- Unexpected crashes of wfreerdp.exe or embedded FreeRDP Windows clients immediately after a clipboard paste action involving remote files.
- Outbound RDP sessions (TCP/3389 or custom RDP ports) to unmanaged or untrusted hosts outside sanctioned remote access gateways.
- Windows Error Reporting entries referencing access violations within the cliprdr channel of FreeRDP binaries.
Detection Strategies
- Inventory endpoints running FreeRDP 3.30.0 through 3.31.x by scanning installed software and third-party RDP client distributions.
- Correlate RDP client process crashes with recent clipboard activity to identify suspect server interactions.
- Monitor for RDP connections initiated from workstations to external or non-corporate IP ranges that could host malicious servers.
Monitoring Recommendations
- Enable application crash telemetry collection for RDP client binaries across managed endpoints.
- Alert on new or anomalous outbound RDP destinations originating from developer or administrator workstations.
- Track clipboard channel usage within RDP sessions where endpoint telemetry supports protocol-level inspection.
How to Mitigate CVE-2026-111376
Immediate Actions Required
- Upgrade all FreeRDP Windows client installations to version 3.32.0 or later.
- Restrict outbound RDP connections to a defined allowlist of trusted servers and gateways.
- Advise users against pasting files from untrusted remote desktop sessions until patches are deployed.
Patch Information
The FreeRDP project addressed this vulnerability in release 3.32.0. The fix adds length validation to the CliprdrStream_New handler so that FILECONTENTS_SIZE responses with fewer than eight bytes are rejected before any read occurs. Refer to the GitHub Security Advisory GHSA-pvgq-84w2-93ph for commit details and vendor guidance.
Workarounds
- Disable clipboard redirection for file transfers in FreeRDP client configuration where business workflows allow.
- Connect only to RDP servers under organizational control until the upgrade is completed.
- Enforce network segmentation that prevents workstations from reaching arbitrary external RDP endpoints.
# Disable clipboard redirection when launching the FreeRDP Windows client
wfreerdp.exe /v:rdp.example.com +clipboard:no
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
