{"id":"CVE-2026-111376","kind":"vulnerability","aliases":["CVE-2026-111376"],"related":[],"title":"FreeRDP Windows client: malicious server causes heap out-of-bounds read","description":"FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.","summary":"FreeRDP's Windows client reads past a heap buffer when a malicious RDP server sends a short clipboard response during a remote file paste. The result is a client crash or a corrupted stream size, and the sources do not describe code execution.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":">= 3.30.0, < 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","package","rdp-clients","windows"],"not_affected_if":["fixed-version","no-untrusted-rdp-servers"],"how_to_check":"- Run `xfreerdp /version` or check the installed FreeRDP version; affected range is `3.30.0` up to but not including `3.32.0`\n- Confirm whether the Windows client build is in use and whether clipboard file redirection is enabled","fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Until patched, disable clipboard redirection for file contents if possible","status":"open","published_at":"2026-10-16T03:18:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:31:03+00:00","updated_at":"2026-10-25T04:31:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:31:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.0` or later\n- Until patched, disable clipboard redirection for file contents if possible","reach":"internet","title":"FreeRDP Windows client: malicious server causes heap out-of-bounds read","impact":"low","summary":"FreeRDP's Windows client reads past a heap buffer when a malicious RDP server sends a short clipboard response during a remote file paste. The result is a client crash or a corrupted stream size, and the sources do not describe code execution.","category":"package","nicknames":[],"who_cares":["freerdp","windows","rdp-clients"],"confidence":0.6,"needs_auth":"no","worst_case":"Client crashes or corrupts clipboard stream size after malicious server response","analyst_note":"","how_to_check":"- Run `xfreerdp /version` or check the installed FreeRDP version; affected range is `3.30.0` up to but not including `3.32.0`\n- Confirm whether the Windows client build is in use and whether clipboard file redirection is enabled","needs_analyst":false,"not_affected_if":["fixed-version","no-untrusted-rdp-servers"],"who_is_affected":"Teams whose staff connect to remote servers with the FreeRDP Windows client at version 3.30.0 to 3.31.x. Exposure depends on a user pasting a file from the remote session, so the risk falls on client machines that connect to servers you do not control. Servers you run yourself and clients on other platforms are outside what the sources describe.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3415,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111376':15A,18A '-2026':14A,17A '3.30.0':71C '3.32.0':73C 'allow':91C 'answer':106C 'attack':104C 'bound':11A,80C 'buffer':34B 'byte':118C 'caus':6A 'cbrequest':113C 'client':3A,24B,29B,54B,86C,128C 'clipboard':43B,102C 'cliprdrstream':88C 'code':67B 'contain':74C 'corrupt':58B,130C 'crash':55B,126C 'cve':13A,16A 'describ':66B 'eight':117C 'execut':68B 'fewer':115C 'file':48B,125C 'filecont':108C 'freerdp':1A,19A,20B,26B,69C 'heap':7A,33B,76C 'invalid':97C 'malici':4A,37B,92C 'memori':98C 'new':89C 'out-of-bound':8A,77C 'packag':21B 'past':31B,49B,122C 'rdp':23B,38B,93C 'rdp-client':22B 'read':12A,30B,81C,99C 'remot':47B,124C 'request':110C 'respons':44B,103C 'result':51B 'send':40B 'server':5A,39B,94C 'short':42B,101C 'size':60B,109C,133C 'sourc':63B 'stream':59B,132C 'trigger':96C 'user':121C 'via':100C 'vulner':82C 'window':2A,25B,28B,85C","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff connect to remote servers with the FreeRDP Windows client at version 3.30.0 to 3.31.x. Exposure depends on a user pasting a file from the remote session, so the risk falls on client machines that connect to servers you do not control. Servers you run yourself and clients on other platforms are outside what the sources describe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111376","severity":null,"published_at":"2026-10-16T03:18:04+00:00","modified_at":"2026-10-20T15:35:25+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}