CVE-2026-67305: 
Wolfi vulnerability analysis and mitigation

CVE-2026-67305 is a heap-based buffer overflow vulnerability in the FreeRDP Windows client (wfreerdp) affecting the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs. The flaw exists because the server-provided size value (cbRequested) is used directly as the length parameter for CopyMemory() without any bounds checking against the destination buffer, allowing a malicious RDP server to trigger arbitrary heap memory corruption. All FreeRDP versions up to and including 3.28.0 are affected; version 3.29.0 contains the fix. It carries a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, FreeRDP Advisory). The vulnerability was published on August 1, 2026.

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The vulnerable code path spans three functions: CliprdrStream_Read() (wf_cliprdr.c:249), wf_cliprdr_server_file_contents_response() (wf_cliprdr.c:2449), and cliprdr_read_file_contents_response() (cliprdr_common.c:384). When the client requests cb bytes of file content, the malicious server responds with a CLIPRDR_FILE_CONTENTS_RESPONSE PDU where dataLen is far larger than cb; the parser computes cbRequested = dataLen - 4 with no upper-bound validation, assigns this server-controlled value to clipboard->req_fsize, and then CliprdrStream_Read() executes CopyMemory(pv, req_fdata, req_fsize) — writing up to 65,536+ bytes into a buffer allocated for only cb bytes (e.g., 16,384 bytes), resulting in a ~49,152-byte out-of-bounds heap write. Exploitation requires clipboard redirection to be enabled (the default) and the victim to perform a paste operation (Ctrl+V) in Windows Explorer after connecting to the malicious server (FreeRDP Advisory).

Successful exploitation enables arbitrary heap memory corruption in the FreeRDP client process, overwriting heap metadata and adjacent heap objects. Under favorable heap layout conditions, an attacker can achieve control-flow hijacking and Remote Code Execution (RCE) with the privileges of the FreeRDP client process. The CVSS v4.0 scoring reflects high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, meaning a compromised client could serve as a pivot point for further lateral movement within the victim's network (GitHub Advisory, FreeRDP Advisory).

1. Set up a malicious RDP server: Deploy the evil_rdp_server.py PoC script (documented in the FreeRDP advisory) on an attacker-controlled host, configuring the --overflow-size parameter (e.g., 65536) to control the overflow magnitude.
2. Lure the victim: Social-engineer or redirect the target user into connecting their FreeRDP Windows client (wfreerdp) to the attacker's server (e.g., via a phishing link, DNS poisoning, or a rogue network).
3. Complete RDP handshake: The malicious server performs a standard RDP negotiation (X.224, MCS, security/license exchange, capability exchange) with clipboard redirection enabled by default, establishing the virtual channel.
4. Initiate clipboard channel: The server sends CB_MONITOR_READY and a FORMAT_LIST PDU advertising CF_HDROP (file drop format), prompting the client to request file content.
5. Trigger the overflow: When the victim performs a paste operation (Ctrl+V) in Windows Explorer, the client sends a FILECONTENTS_RANGE request for cb bytes. The malicious server responds with a CLIPRDR_FILE_CONTENTS_RESPONSE PDU where dataLen = OVERFLOW_SIZE + 4 (e.g., 65540), causing cbRequested = 65536 to be assigned to clipboard->req_fsize.
6. Achieve heap corruption: CliprdrStream_Read() executes CopyMemory(pv, req_fdata, req_fsize), writing 65,536 bytes into a ~16,384-byte buffer, corrupting adjacent heap objects including IStreamVtbl function pointers.
7. Gain code execution: Under a crafted heap layout, OLE virtual calls (e.g., Release, Read, Stat) on the corrupted adjacent IStream object redirect execution to attacker-controlled addresses, achieving RCE with the privileges of the wfreerdp process (FreeRDP Advisory).

• Network: Inbound RDP connections (TCP port 3389 or non-standard ports like 13389) from unknown or untrusted external IP addresses to client workstations; unusual outbound connections from the FreeRDP client process following an RDP session.
• Process: Unexpected child processes spawned by wfreerdp.exe (e.g., cmd.exe, powershell.exe, curl.exe); wfreerdp.exe crashing with access violations or heap corruption errors (SIGSEGV / STATUS_HEAP_CORRUPTION) during or after clipboard paste operations.
• Logs: Windows Event Log entries showing wfreerdp.exe application crashes (Event ID 1000/1001) with fault module related to heap operations; Windows Error Reporting (WER) crash dumps for wfreerdp.exe generated during clipboard activity.
• File System: Unexpected WER crash dump files (.dmp) in %LOCALAPPDATA%\CrashDumps\ or %TEMP% associated with wfreerdp.exe; new or modified files in user-writable directories created by wfreerdp.exe or its child processes shortly after an RDP session.

Update the FreeRDP Windows client to version 3.29.0 or later, which contains the fix for this vulnerability (FreeRDP Advisory). Note that the FreeRDP project also states that wfreerdp is unmaintained and should not be used; users are advised to migrate to a supported client. As an interim workaround, disable clipboard redirection in RDP client settings (/clipboard flag) if clipboard functionality is not required, or restrict RDP connections exclusively to trusted, known-good servers. Avoid connecting to untrusted or unknown RDP servers until the patch is applied.