CVE-2026-44420: Freerdp

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

Affected products

• Freerdp Freerdp: before 3.26.0 (fixed in 3.26.0)

Published 2026-05-29. Last modified 2026-07-27.