CVE-2026-44420— FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44420
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44420
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44420
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44420 (1)
Same Patch Batch · FreeRDP · 2026-05-29 · 4 CVEs total
| CVE-2026-44421 | 8.8 HIGH | FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass |
| CVE-2026-44422 | 7.5 HIGH | FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion |
| CVE-2026-45700 | Heap-buffer-overflow write in planar bitmap decoder |
IV. Related Vulnerabilities
Same product: FreeRDP
- CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder - CVE-2026-44422
FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/do - CVE-2026-44421
FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamp - CVE-2026-40033
FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rec - CVE-2026-40254
FreeRDP: contains_dotdot() off-by-one allows drive channel p
Same vendor: FreeRDP
- CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder - CVE-2026-44422
FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/do - CVE-2026-44421
FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamp - CVE-2026-40033
FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rec - CVE-2026-40254
FreeRDP: contains_dotdot() off-by-one allows drive channel p
V. Comments for CVE-2026-44420
No comments yet