Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.
Two CVE records describe the same heap overflow in the same FreeRDP function.
CVE-2026-67305 (CVSS v4 9.4): "Windows client before 3.29.0."
CVE-2026-68579: "before 3.30.0 (<= 3.29.0)."
So we read the source. 🧵
Post summary
The passage announces two CVE records for the same heap‑overflow flaw in FreeRDP, affecting Windows clients before versions 3.29.0 and 3.30.0, and provides version guidance and a CVSS score but no PoC, exploit, or patch details.
🚨Critical - Two FreeRDP client flaws: TLS cert-validation bypass and HTTP proxy request injection (CVE-2026-66402 & CVE-2026-67289)
Both affect FreeRDP <= 3.28.0 and are fixed in 3.29.0.
CVE-2026-66402 (CWE-295): FreeRDP does custom CN/DNS-SAN matching instead of OpenSSL's length-aware APIs, so it truncates DNS SANs at embedded NUL bytes, accepts a matching Common Name even when non-matching SANs are present, and accepts IP-literal targets without checking iPAddress SANs. An attacker who can present a trusted or misissued certificate can bypass server identity verification and MitM the RDP session.
CVE-2026-67289 (CWE-113): FreeRDP doesn't validate CRLF/control chars in the server-controlled RDP redirection TargetNetAddress. When the client connects through an HTTP proxy, that value is written unfiltered into the proxy CONNECT line and Host header, letting a malicious server inject arbitrary requests/headers into the proxy connection.
Both are client-side MitM-class bugs, CVSS 9.8. FreeRDP underpins many remote-desktop tools, so the footprint is broad.
👉Upgrade FreeRDP to 3.29.0 (also fixes the clipboard RCE CVE-2026-67305).
Post summary
The text announces two client‑side FreeRDP vulnerabilities, details their technical impact, and recommends upgrading to the patched 3.29.0 release.
🚨Critical - FreeRDP Clipboard CLIPRDR Heap Overflow RCE (CVE-2026-67305)
FreeRDP Windows client clipboard virtual channel mishandles CLIPRDR_FILE_CONTENTS_RESPONSE PDUs by trusting the server-provided size and copying into a fixed heap buffer without bounds checks. A malicious RDP server can return an oversized payload during a paste action, corrupt heap memory and potentially achieve RCE.
👉Affected: FreeRDP Windows client < 3.29.0 | Upgrade to 3.29.0
Post summary
CVE-2026-67305 is a critical heap overflow that can lead to remote code execution in FreeRDP's clipboard handling, and upgrading to version 3.29.0 addresses the issue.
