Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.
Affected products
freerdp: freerdp
References7
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3… ExploitMitigationVendor Advisory
- access.redhat.com/errata/RHSA-2026:36203
- access.redhat.com/errata/RHSA-2026:46393
- access.redhat.com/security/cve/CVE-2026-44420
- bugzilla.redhat.com/show_bug.cgi?id=2483480
- github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5…
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44420…
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 5% percentile: 92 · as of 15 November 2026
- CWE
- CWE-122CWE-131
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.