CVE-2026-68579

FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function (client/Windows/wfcliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file contents from the RDP server and then copies the response into the caller's buffer using the server-supplied length (reqfsize) instead of cb. A malicious or compromised RDP server can return an oversized CBFILECONTENTSRESPONSE, causing an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer when a user pastes server-offered clipboard file contents.