Loading story…
A critical heap-based buffer overflow tracked as CVE-2026-68579 affects FreeRDP versions up to and including 3.29.0 in the Windows clipboard client function CliprdrStream_Read. The flaw occurs because FreeRDP copies server-returned file contents using an attacker-controlled length value rather than the fixed-size buffer length supplied by the caller, creating an out-of-bounds heap write. The issue has been rated CVSS 9.6 under v3.1 and 8.7 under v4.0.
A malicious or compromised RDP server can trigger the bug during clipboard file paste operations by sending an oversized CB_FILECONTENTS_RESPONSE, causing attacker-controlled data to be written into the heap buffer of the paste consumer, such as explorer.exe. The vulnerable code is located in client/Windows/wf_cliprdr.c, and the reported fix is to upgrade to FreeRDP 3.30.0 or later.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 2, 2026, VulnCheck and downstream CVE reporting published details for CVE-2026-68579, describing the FreeRDP CliprdrStream_Read heap overflow as remotely exploitable and recommending upgrades to version 3.30.0 or later. The issue was rated Critical under CVSS v3.1 with a score of 9.6.
FreeRDP version 3.30.0 fixed a heap-based buffer overflow in the Windows clipboard client function CliprdrStream_Read that affected versions up to and including 3.29.0. The flaw allowed a malicious or compromised RDP server to trigger an out-of-bounds heap write during clipboard file paste operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical heap-based buffer overflow** in FreeRDP affects versions through `3.27.1`, allowing an unauthenticated attacker to trigger memory corruption before authentication when **RDP Standard Security** is enabled. The flaw is in `crypto_rsa_common()` in `libfreerdp/crypto/crypto.c`, where `BN_bn2bin()` writes decrypted modular-exponentiation output into a caller-supplied buffer before verifying that the data fits, creating an out-of-bounds heap write condition. An attacker can exploit the issue by sending a crafted RSA ciphertext for the encrypted client random during the RDP handshake. Because the server exposes its RSA public key, the ciphertext can be made to decrypt to data as large as the RSA modulus length—such as `256` bytes with `RSA-2048`—while the target buffer is only `32` bytes, producing roughly `224` bytes of attacker-controlled overflow and causing denial of service. The vulnerability is tracked as **`CVE-2026-64620`**, carries a **CVSS v3.1 score of 9.8**, and is fixed in **FreeRDP `3.28.0`**.
Jul 21, 2026
A high-severity double-free vulnerability tracked as **`CVE-2026-64621`** was disclosed in **FreeRDP** versions **3.x through 3.27.1**, affecting the parsing of the `selectedmonitors` field in `.rdp` connection files. The flaw is located in `freerdp_client_rdp_file_apply_to_settings()` in `client/common/file.c`, where an error path can free a non-owning pointer and leave `settings->MonitorIds` dangling, leading to a second free during teardown. The issue is classified as **CWE-415** and can affect FreeRDP CLI clients including **`xfreerdp`**, **`sdl-freerdp`**, and **`wlfreerdp`** in their default configurations. Attackers could exploit the bug by persuading a user to open a crafted `.rdp` file containing oversized monitor tokens, resulting in a size-controlled double-free with potential impacts to **integrity** and **availability**, and limited **confidentiality** exposure under the published CVSS assessment. The vulnerability has been fixed in **FreeRDP 3.28.0**, and public references include a GitHub security advisory, a fixing commit in the FreeRDP repository, and a VulnCheck advisory.
Jul 20, 2026
Microsoft released fixes for two **Windows Remote Desktop Protocol (RDP)** information disclosure vulnerabilities, `CVE-2026-42908` and `CVE-2026-45639`, that allow a remote, unauthenticated attacker to trigger out-of-bounds reads and expose sensitive memory without user interaction. According to reporting on the June 9, 2026 security updates, `CVE-2026-42908` can disclose local memory addresses and weaken **ASLR**, while `CVE-2026-45639` can reveal process memory including credentials, session tokens, and protocol state data. Microsoft rated both flaws **Important** with **CVSS 7.5** and said exploitation was considered less likely at release, with no public exploits reported. The vulnerabilities affect a broad set of Windows platforms, including **Windows 10**, **Windows 11**, **Windows Server 2012 through 2025**, and Microsoft’s Remote Desktop client offerings for Windows desktop. The disclosures arrive amid continued scrutiny of the RDP ecosystem after earlier reports of severe Remote Desktop weaknesses, including `CVE-2025-29967` in **RD Gateway** and `CVE-2025-29966` and `CVE-2025-48817` in the **Windows Remote Desktop Client**, which were described as enabling remote code execution through heap overflow or path traversal conditions. Organizations were urged to prioritize patching internet-exposed RDP systems and strengthen access controls with VPNs, bastion hosts, strong authentication, and monitoring.
Jun 29, 2026