FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a… (CVE-2026-109248)

The vulnerability in FreeRDP 3.0.0 before 3.32.0 is a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(). The function scans a FILEDESCRIPTORW cFileName field controlled by the RDP server using unbounded _wcschr() and count_special_chars() calls without a guarantee of NUL-termination. This allows a malicious RDP server to send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE message, which triggers a heap out-of-bounds read and crashes clients using X11, Wayland, and SDL when the user pastes files copied from the server.

The vulnerability can cause denial of service by crashing client applications (X11, Wayland, SDL) when pasting files copied from a malicious RDP server. There is no indication of confidentiality or integrity impact. The CVSS score is 6.5 (medium severity) with no privileges required and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid pasting files copied from untrusted or unknown RDP servers to prevent crashes.