CVE-2026-44420 Details
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.
A heap-buffer overflow vulnerability has been identified in FreeRDP versions prior to 3.26.0, specifically within the server-side clipboard (cliprdr) channel. This vulnerability allows a malicious RDP client to cause a heap-buffer overflow by sending a CB_CLIP_CAPS PDU with an undersized capabilitySetLength. The resulting heap memory corruption can lead to a crash of the server process, causing a remote denial-of-service condition, and may also be exploitable for code execution. The vulnerability arises in the capability parsing routine of the cliprdr server, where improper validation of the capabilitySetLength allows for out-of-bounds writes.
Users can upgrade to FreeRDP version 3.26.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:36203 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:46393 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-44420 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2483480 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44420.json | redhat-SADP | |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8 | CISA-ADP | |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3p3r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.26.0 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 29, 2026 | New CVE Received | [email protected] |