CVE-2026-111376

A flaw was found in FreeRDP. When handling remote file clipboard transfers on Windows clients, the application fails to properly validate the length of file size responses returned by a Remote Desktop Protocol (RDP) server. A malicious RDP server can exploit this by returning an abnormally short response when a user pastes a remote file, triggering an out-of-bounds memory read. This can cause the client application to terminate unexpectedly, resulting in a Denial of Service (DoS).

A moderate-severity heap out-of-bounds read flaw was found in FreeRDP's Windows client clipboard file transfer handling (CliprdrStream_New). When a user pastes or opens a remote file offered through the clipboard by a malicious RDP server, the server can answer the client's FILECONTENTS_SIZE request with a response shorter than the required eight bytes; the client allocates only that shorter buffer but still dereferences it as an eight-byte value, reading beyond the end of the heap allocation. This can terminate the client application (denial of service) or leave an invalid internal stream size that corrupts the clipboard file transfer. The over-read is bounded to a few bytes of adjacent heap memory, and the upstream advisory does not establish code execution, session hijacking, or an authentication bypass. Exploitation requires a user to connect to an attacker-controlled RDP server and then paste or open a remote clipboard file. Red Hat rates this flaw Moderate impact (CVSS 3.1: 5.0, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L), while the upstream CVSS 4.0 score is 2.3 (Low); the difference stems primarily from CVSS version metric changes rather than a substantive disagreement about the vulnerability. The freerdp and freerdp2 packages are recorded as affected across Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and Fedora/EPEL community streams. Fixes for the affected Red Hat streams are currently deferred; until a fixed package is released, the residual risk is a client-side crash or corrupted clipboard file transfer when users connect to untrusted RDP servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.