Vulnerability Details CVE-2026-111376
FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file, crashing the client or corrupting the stream size.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 2.8%
CVSS Severity
CVSS v3 Score 5.0
References