A malicious RDP client can send a CB_CLIP_CAPS PDU with an undersized capabilitySetLength to a FreeRDP server. This causes a heap-buffer-overflow write in the server‑side clipboard (cliprdr) channel. The overflow can crash the server, resulting in a denial‑of‑service, and it may corrupt heap memory in a way that could lead to arbitrary code execution if an attacker can control the corrupted data. The flaw is a classic heap corruption problem classified as CWE‑122.

FreeRDP FreeRDP servers running any version prior to 3.26.0 are affected. The vulnerability was fixed in release 3.26.0, so any deployment of an older version is vulnerable unless otherwise patched.

The CVSS score of 8.8 reflects a high risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting that the Exploit Development Phase is moderate. The likely attack vector involves a remote RDP client initiating a connection to the target server and sending the malformed CB_CLIP_CAPS packet. An attacker who can establish an RDP session, including trusted or unauthenticated access, can trigger the overflow, causing a crash and potentially executing code if heap corruption leads to executable payload placement. The exploitation requires the victim to be running a vulnerable FreeRDP server in a network reachable to the attacker.