CVE-2026-109248

MediumCVSS 6.5/10Last modified Nov 2, 2026

Description

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	>= 3.0.0, < 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp2r-gm4v-wvq2Exploit, Vendor Advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-heap-out-of-bounds-read-via-winpr-clipboard-cfilenameThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp2r-gm4v-wvq2Exploit, Vendor Advisory

Timeline

Published: Oct 12, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1092495.5FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing CVE-2026-109258.3Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces CVE-2026-1092506.6FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fi CVE-2026-1092515.3FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the CVE-2026-1092525.3FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to CVE-2026-1092535.3FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length bef CVE-2026-1092545.9FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats CVE-2026-1092556.8FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server t CVE-2026-1092566.5FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a reall CVE-2026-1092577.5FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a pa CVE-2026-1092587.5ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an CVE-2026-1092595.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory c