CVE-2026-111376
MediumCVSS 5.0Summary
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file.
Risk Assessment
Potential crash of the RDP client or corruption of the stream size, leading to data loss or further exploitation. The risk affects users connecting to malicious RDP servers.
Recommendation
Update FreeRDP to version 3.32.0 or later. Avoid connecting to untrusted RDP servers until the fix is applied.
Other vulnerabilities in FreeRDP
See all- CVE-2026-111382High
FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.
- CVE-2026-111381High
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2. A local attacker can corrupt heap memory via integer wraparound in bitmap size calculation by supplying a crafted v2 persistent cache file with oversized width and height values.
- CVE-2026-111380High
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.
- CVE-2026-111379High
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.
- CVE-2026-111378High
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.
- CVE-2026-111377Medium
FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.
- CVE-2026-111375Medium
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing heap over-reads, title corruption, or client crashes.
- CVE-2026-111374Medium
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client. A malicious RDP server can request unadvertised camera media types by sending a StartStreamsRequest with oversized dimensions, forcing large allocations and reconfiguring the local camera via the HAL.
- CVE-2026-111373Medium
FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport. A malicious gateway can send zero-length pings, causing a nullptr stream to be passed to websocket_reply_close and crashing the client.
- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
Original NVD description (English source)
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS