CVE-2026-68579: 
Wolfi vulnerability analysis and mitigation

CVE-2026-68579 is a heap-based buffer overflow vulnerability in FreeRDP's Windows clipboard client, specifically in the CliprdrStream_Read function (client/Windows/wf_cliprdr.c). It affects all FreeRDP versions up to and including 3.29.0, and was disclosed on August 2, 2026, with a patch available in FreeRDP 3.30.0. The vulnerability was discovered using AI-assisted analysis by Anthropic (Claude) and validated by Ada Logics. It carries a CVSS v3.1 base score of 9.6 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is an out-of-bounds write (CWE-787) in CliprdrStream_Read(). When an OLE paste consumer such as explorer.exe calls IStream::Read(pv, cb, ...) with a fixed-size buffer of cb bytes, the function sends a bounded CB_FILECONTENTS_RANGE request to the RDP server, then copies the server's response into the caller's buffer using the server-supplied length (req_fsize) rather than the caller-specified cb: CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize);. A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE, causing req_fsize to exceed cb and writing attacker-controlled data beyond the heap buffer boundary in the paste consumer's process. The fix is to clamp the copy length to min(req_fsize, cb) before performing the CopyMemory operation (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker controlling a malicious or compromised RDP server to achieve remote code execution in the OLE paste consumer process (e.g., explorer.exe) on the Windows client machine. The overflow writes attacker-controlled data into a heap buffer outside the FreeRDP process itself, meaning the impact extends to the host operating system's shell process. This results in high integrity and availability impact, with limited confidentiality impact, and could enable full system compromise, lateral movement, or persistent access (GitHub Advisory, GitHub Advisory DB).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of crafting and sending oversized CB_FILECONTENTS_RESPONSE PDUs in response to CB_FILECONTENTS_RANGE requests from the client.
2. Lure the victim to connect: Social-engineer or redirect a Windows user running a vulnerable FreeRDP client (version ≤ 3.29.0) to connect to the attacker-controlled RDP server.
3. Offer clipboard file contents: Configure the malicious RDP server to advertise file-based clipboard content (e.g., a file object) to the client, making it available for paste operations.
4. Trigger the paste action: Wait for or prompt the user to paste the server-offered clipboard file contents in a Windows application (e.g., drag-and-drop or Ctrl+V in Explorer), causing explorer.exe to call IStream::Read via the COM interface.
5. Send oversized response: When the FreeRDP client sends a bounded CB_FILECONTENTS_RANGE request for cb bytes, respond with a CB_FILECONTENTS_RESPONSE containing significantly more data than cb.
6. Trigger heap overflow: CliprdrStream_Read copies the full server-supplied req_fsize bytes into the cb-byte heap buffer in explorer.exe, overwriting adjacent heap memory with attacker-controlled content.
7. Achieve code execution: Leverage the heap overflow to corrupt heap metadata or function pointers in explorer.exe, ultimately redirecting execution to attacker-controlled shellcode or a ROP chain (GitHub Advisory).

• Network: Outbound RDP connections (TCP port 3389 or custom ports) from Windows hosts to unknown or untrusted external IP addresses; unusually large CB_FILECONTENTS_RESPONSE PDUs in RDP traffic captures.
• Process: Unexpected child processes spawned by explorer.exe (e.g., cmd.exe, powershell.exe, curl.exe); explorer.exe crashing or restarting unexpectedly after a clipboard paste operation.
• Logs: Windows Event Log entries showing explorer.exe application crashes (Event ID 1000/1001) correlated with active FreeRDP RDP sessions; heap corruption-related crash dumps in %LOCALAPPDATA%\CrashDumps\.
• File System: Unexpected files written to user-accessible directories by explorer.exe following an RDP clipboard paste event; new scheduled tasks or registry run keys created around the time of the crash.

Upgrade FreeRDP to version 3.30.0 or later, which clamps the CopyMemory length to min(req_fsize, cb) to prevent the overflow (GitHub Advisory). As interim workarounds: disable clipboard redirection in RDP sessions if not operationally required; restrict RDP client connections to trusted, verified servers only; and educate users to avoid pasting clipboard content received from untrusted RDP sessions. Organizations using FreeRDP in enterprise environments should prioritize patching given the Critical CVSS v3.1 score and the potential for RCE in explorer.exe.

The vulnerability was discovered through AI-assisted security research by Anthropic (using Claude agents) and validated and reported by Ada Logics, representing a notable example of AI-driven vulnerability discovery in open-source software (GitHub Advisory). Coverage appeared on The Hacker Wire shortly after disclosure, and the vulnerability was indexed by VulnDB and other threat intelligence aggregators within hours of publication. No significant public researcher debate or vendor controversy has been observed.