CVE-2026-44420— FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44420
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPS
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
堆缓冲区溢出
Source: NVD (National Vulnerability Database)
Vulnerability Title
FreeRDP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 3.26.0之前版本存在安全漏洞，该漏洞源于恶意RDP客户端可通过发送具有过小capabilitySetLength的CB_CLIP_CAPS PDU触发服务器端剪贴板通道的堆缓冲区溢出写入，可能导致服务器进程崩溃或代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44420
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 10169 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44420
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44420 (1)
Same Patch Batch · FreeRDP · 2026-05-29 · 4 CVEs total
| CVE-2026-44421 | 8.8 HIGH | FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass |
| CVE-2026-44422 | 7.5 HIGH | FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion |
| CVE-2026-45700 | Heap-buffer-overflow write in planar bitmap decoder |
IV. Related Vulnerabilities
Same product: FreeRDP
- CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder - CVE-2026-44422
FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/do - CVE-2026-44421
FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamp - CVE-2026-40033
FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rec - CVE-2026-40254
FreeRDP: contains_dotdot() off-by-one allows drive channel p
Same vendor: FreeRDP
- CVE-2026-45700
Heap-buffer-overflow write in planar bitmap decoder - CVE-2026-44422
FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/do - CVE-2026-44421
FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamp - CVE-2026-40033
FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rec - CVE-2026-40254
FreeRDP: contains_dotdot() off-by-one allows drive channel p
Same weakness: CWE-122
V. Comments for CVE-2026-44420
No comments yet