CVE-2026-67305 is a high severity heap buffer overflow in the FreeRDP Windows client, wfreerdp, in the clipboard channel. The record scores it 8.8 and the advisory 9.4. Versions up to 3.28.0 are affected and 3.29.0 is patched. The project says wfreerdp is unmaintained and should not be used.
What's affected
The FreeRDP Windows client (wfreerdp) in versions up to and including 3.28.0. The patched version is 3.29.0.
Severity differs by source. The record gives CVSS 8.8 (High). The GitHub advisory labels it Critical with a score of 9.4. The weakness is CWE-122, a heap based buffer overflow.
The advisory opens with an important notice. It says wfreerdp is unmaintained and should not be used. It says the build has shown a message to that effect for years, and that the project has now also removed it from nightly builds. So the best fix for many people is to stop using this client.
The advisory says a malicious RDP server can answer a clipboard file contents request with far more data than was asked for. The size comes from the server, and the client uses it as the copy length without checking it against the destination buffer. That corrupts heap memory in the client process, and under favorable conditions can lead to code execution.
How to check if you're exposed
Find out whether anyone uses the Windows client from FreeRDP, wfreerdp, in your organization. It may live in a developer's tool folder or inside a bundled application. Read the version it reports. Anything up to 3.28.0 is in scope. The cross platform clients from the same project, such as xfreerdp, are not the component the advisory names.
The attack path also needs two things from the user. They connect to the malicious server, with clipboard redirection on, which the advisory says is the default. Then they perform a paste in Windows Explorer.
What to do now
- Replace wfreerdp with a maintained client, as the project advises.
- If you must keep it, upgrade to 3.29.0 or later.
- Turn off clipboard redirection for connections to servers you do not fully trust.
- Connect only to RDP servers you control or trust.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
A heap buffer overflow in a client matters because the client trusts the server's data. Here the length of a copy came straight from a network message. When the destination is smaller than that length, the copy runs past the end of it.
RDP client flaws reverse the usual picture. The server is the attacker, and a user on a normal workstation is the victim. The advisory describes memory corruption and a potential for control flow hijacking, and says remote code execution is possible under favorable heap layout. It stays a conditional claim.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Do I need to patch if I use xfreerdp on Linux?
The advisory names the Windows client, wfreerdp. Still upgrade to 3.29.0 to pick up other fixes in that release.
What does the user have to do for the attack to work?
Connect to a malicious server with clipboard redirection enabled, and paste in Windows Explorer.
Sources
- FreeRDP advisory GHSA-cj9v-h4hq-29jr
- VulnCheck advisory for FreeRDP Windows client clipboard overflow
Last reviewed: 18 October 2026.
