8.8 High

CVE-2026-44420 FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
FreeRDP 3.26	earliest → < 3.26.0	3.26.0
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 6	Versions not published
Red Hat Enterprise Linux 7	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat Enterprise Linux AppStream (v. 10)	Versions not published
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)	Versions not published

References

github.com github.com

Timeline

Published May 29, 2026
Last modified November 3, 2026

The 324 CVEs of FreeRDP →

CVE-2026-121964 FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment 8.7 High CVE-2026-121962 FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read 7.2 High CVE-2026-121963 FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close 8.2 High CVE-2026-121961 FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race 8.2 High

Track this CVE