Critical FreeRDP Clipboard Virtual Channel Heap Buffer Overflow (GHSA-cj9v-h4hq-29jr, CVSS 9.4)

Key facts for FreeRDP CLIPRDR heap overflow

Detection coverage for FreeRDP CLIPRDR heap overflow

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1689 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FreeRDP CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (SPL)

Detects the core exploitation pattern for GHSA-cj9v-h4hq-29jr: an RDP CLIPRDR_FILECONTENTS_RESPONSE PDU whose server-supplied cbRequested/dataLen field substantially exceeds the client's own file-contents-request size, correlated with a wfreerdp.exe access-violation (0xc0000005) crash on the same host shortly afterward. This is the network+host correlation of the unvalidated-length heap overflow in cliprdr_read_file_contents_response()/CliprdrStream_Read().

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1204, T1115, T1499.004
• Data sources: sysmon, windows_security, wineventlog_application, rdp_proxy_network_sensor
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="rdp:cliprdr_virtual_channel" pdu_type="CLIPRDR_FILECONTENTS_RESPONSE"
| eval overflow_bytes=cbRequested-client_requested_len
| where overflow_bytes>0
| eval pdu_time=_time
| join type=left host [
    search index=wineventlog sourcetype="WinEventLog:Application" EventCode=1000 ProcessName="wfreerdp.exe" ExceptionCode="0xc0000005"
    | eval crash_time=_time
    | fields host, user, ProcessName, FaultingModule, crash_time
]
| eval correlated_crash=if(isnotnull(crash_time) AND (crash_time-pdu_time)>=0 AND (crash_time-pdu_time)<=30, "yes", "no")
| where overflow_bytes>16384 OR correlated_crash="yes"
| table _time host user ProcessName client_requested_len cbRequested overflow_bytes crash_time correlated_crash FaultingModule server_ip
| sort -_time

Microsoft KQL

let LookbackWindow = 24h;
let CliprdrPdus = RdpCliprdrEvents_CL
| where TimeGenerated > ago(LookbackWindow)
| where PduType_s == "CLIPRDR_FILECONTENTS_RESPONSE"
| extend OverflowBytes = toint(ServerClaimedLen_d) - toint(ClientRequestedLen_d)
| where OverflowBytes > 0
| project TimeGenerated, DeviceName = DeviceName_s, RemoteIP = RemoteIP_s, ClientRequestedLen = toint(ClientRequestedLen_d), ServerClaimedLen = toint(ServerClaimedLen_d), OverflowBytes;
let WfreerdpCrashes = Event
| where TimeGenerated > ago(LookbackWindow)
| where EventLog == "Application" and Source == "Application Error" and EventID == 1000
| where RenderedDescription has "wfreerdp.exe" and RenderedDescription has "0xc0000005"
| project CrashTime = TimeGenerated, DeviceName = Computer;
CliprdrPdus
| join kind=leftouter WfreerdpCrashes on DeviceName
| extend CorrelatedCrash = iff(isnotempty(CrashTime) and CrashTime between (TimeGenerated .. TimeGenerated + 30s), "yes", "no")
| where OverflowBytes > 16384 or CorrelatedCrash == "yes"
| project TimeGenerated, DeviceName, RemoteIP, ClientRequestedLen, ServerClaimedLen, OverflowBytes, CorrelatedCrash
| sort by TimeGenerated desc

Sigma

title: FreeRDP wfreerdp Crash Following Oversized CLIPRDR File-Contents-Response (GHSA-cj9v-h4hq-29jr Exploitation Attempt)
id: 8f1c3a2e-1689-4a1e-9b1a-tl16891exp01
status: experimental
description: Detects wfreerdp.exe terminating with an access-violation (0xc0000005) fault immediately following a clipboard file-contents exchange, consistent with exploitation of the CLIPRDR_FILECONTENTS_RESPONSE heap buffer overflow (GHSA-cj9v-h4hq-29jr, CVSS 9.4, CWE-122).
references:
    - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr
    - https://gbhackers.com/critical-freerdp-clipboard-flaw/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204
    - attack.collection
    - attack.t1115
    - attack.impact
    - attack.t1499.004
    - cve.ghsa-cj9v-h4hq-29jr
logsource:
    product: windows
    service: application
    category: application_crash
detection:
    selection:
        Provider: 'Application Error'
        EventID: 1000
        ProcessName|contains: 'wfreerdp.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Unrelated wfreerdp crashes caused by memory pressure or unrelated bugs unconnected to a CLIPRDR exchange
    - Crashes on FreeRDP 3.29.0+ (patched) triggered by unrelated defects
level: high

Known false positives:

• Unrelated wfreerdp crashes from memory pressure or unrelated bugs unconnected to a CLIPRDR exchange
• Crashes on FreeRDP 3.29.0+ (patched) triggered by unrelated defects

Tuning notes: Tune the overflow_bytes threshold (default: flag PDUs where the server-claimed length exceeds 2x the client's request, or any value beyond 16 KB) to the environment's typical CLIPRDR transfer sizes; extend the crash-correlation window if network sensor and endpoint clocks are not tightly synced (NTP drift).

• 🔒 [indicator] CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (KQL) · unlock with TL Creds
• 🔒 Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (KQL) · unlock with TL Creds
• 🔒 [indicator] CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (SPL) · unlock with TL Creds
• 🔒 Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (SPL) · unlock with TL Creds

Indicators of compromise for FreeRDP CLIPRDR heap overflow

As of 2026-07-25, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-1689.

How FreeRDP CLIPRDR heap overflow works

No CVE has been assigned as of analysis; affects FreeRDP <= 3.28.0, fixed in 3.29.0.

FreeRDP's Windows client (wfreerdp) contains a heap-based buffer overflow (CWE-122) in its clipboard redirection (CLIPRDR) virtual-channel handling, disclosed by FreeRDP maintainers as GHSA-cj9v-h4hq-29jr and credited to Tencent Yunding Security Lab (discoverer 'cbcs', reported by 'hyperlyz'). The flaw sits in the file-contents-response path: when the client requests a chunk of clipboard file data from an RDP server, the server's CLIPRDR_FILECONTENTS_RESPONSE reply carries a length field (cbRequested/dataLen) that is attacker-controlled. The vulnerable call chain is cliprdr_read_file_contents_response() (channels/cliprdr/cliprdr_common.c), which extracts the server-supplied length without validating it against the client's original request size, followed by wf_cliprdr_server_file_contents_response() (client/Windows/wf_cliprdr.c), which stores the oversized value, and finally CliprdrStream_Read(), which performs a CopyMemory() using that unvalidated length into a fixed/undersized destination buffer. Public write-ups describe cbRequested being manipulated up to 65,536 bytes, so a client that requested 16 KB and receives a crafted 64 KB response can have roughly 48 KB written past the intended heap allocation.

Exploitation requires a victim's wfreerdp client to connect to an attacker-controlled or attacker-compromised RDP server with clipboard redirection enabled (the Windows default) and to perform a clipboard paste operation (e.g., Ctrl+V in Explorer) that triggers a file-contents request/response exchange. Consequences documented across sources range from an immediate process crash (SIGSEGV) to heap metadata corruption affecting adjacent allocations and, under favorable heap layout/allocator conditions, control-flow hijacking and remote code execution in the context of the connecting user.

As of publication no CVE identifier has been assigned to GHSA-cj9v-h4hq-29jr, no public proof-of-concept exploit has been released, and no in-the-wild exploitation has been reported. The advisory was published alongside FreeRDP 3.29.0 (released 2026-07-13) as part of a coordinated batch of 22 security advisories from multiple independent researchers (Bin Luo/UESTC, Team Atlanta, @canomer, @HEXER365, and Tencent Yunding Security Lab). Notably, the FreeRDP maintainers state in the advisory that wfreerdp itself "is unmaintained and should not be used" and has been removed from nightly builds, making migration off the component — not just patching — the recommended long-term remediation.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Collection

T1115 Clipboard Data

Initial Access

T1133 External Remote Services; T1199 Trusted Relationship; T1566 Phishing

Execution

T1203 Exploitation for Client Execution; T1204 User Execution

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1499.004 Application or System Exploitation

Resource Development

T1583.003 Virtual Private Server; T1584.004 Server; T1608 Stage Capabilities

Reconnaissance

T1595.002 Vulnerability Scanning

stealth

T1684.001 Impersonation

Remediation for FreeRDP CLIPRDR heap overflow

Patches

• FreeRDP 3.29.0 (released 2026-07-13) — fixes GHSA-cj9v-h4hq-29jr as part of a batch of 22 security advisories

Immediate actions

• Upgrade all FreeRDP-based Windows clients (wfreerdp) to version 3.29.0 or later immediately
• Disable clipboard redirection (CLIPRDR virtual channel) for RDP connections to untrusted or internet-facing servers
• Restrict outbound RDP connections from managed endpoints to an allow-list of known-good RDP servers

Workarounds

• Disable clipboard redirection entirely for the RDP session (client setting or Group Policy) if immediate upgrade is not possible
• Block outbound RDP connections to unknown/untrusted external servers via firewall/network egress rules

Longer-term hardening

• Migrate off wfreerdp, which FreeRDP maintainers have explicitly stated is unmaintained and should not be used, to a currently supported RDP client
• Enforce mutual authentication and network-level access controls (e.g. VPN/ZTNA gateways) for all outbound RDP sessions
• Monitor endpoints for unexpected FreeRDP/wfreerdp process crashes (SIGSEGV) as a potential exploitation indicator
• Include FreeRDP and other bundled open-source RDP components in regular third-party/open-source software patch-management cycles

Affected and fixed versions

• FreeRDP — FreeRDP Windows Client (wfreerdp)
  Vulnerable versions: <= 3.28.0
  Fixed in: 3.29.0

Timeline of FreeRDP CLIPRDR heap overflow

• 2026-07-13 locked-ioc-18/locked-ioc-18 publishes the corresponding GitHub Release tag '3.29.0', formalizing the version boundary (<= 3.28.0 vulnerable, 3.29.0 fixed) referenced by the security advisory.
• 2026-07-13 locked-ioc-18 3.29.0 released, containing the fix for GHSA-cj9v-h4hq-29jr along with 21 other security advisories from multiple independent researchers.
• 2026-07-15 Help Net Security, Linuxiac, and news4hackers independently publish coverage of the locked-ioc-18 3.29.0 security update resolving all 22 advisories, the same day the advisories were disclosed.
• 2026-07-15 locked-ioc-18 discloses 22 total security advisories alongside the 3.29.0 release — 18 from Bin Luo (University of Electronic Science and Technology of China), and one each from @canomer, Team Atlanta, @HEXER365, and locked-ioc-11 (GHSA-cj9v-h4hq-29jr) — described by maintainer Armin Novak as the result of 'a very rigorous review since our last release by a couple of security researchers.'
• 2026-07-15 Advisory text states locked-ioc-16 is unmaintained and should not be used, and notes it has been removed from locked-ioc-18 nightly builds.
• 2026-07-15 locked-ioc-18 maintainers publish GitHub Security Advisory GHSA-cj9v-h4hq-29jr, disclosing the locked-ioc-16 CLIPRDR heap buffer overflow and crediting locked-ioc-11 (discoverer 'cbcs', reported by 'locked-ioc-17').
• 2026-07-23 TL-Intel-Harness HUNT phase surfaces the threat via the GBHackers RSS feed (source article published 2026-07-23).
• 2026-07-23 GBHackers and CyberPress independently publish write-ups specifically on the critical clipboard flaw, highlighting the CVSS 9.4 severity, the exact vulnerable-function chain, and RCE-via-vtable-hijacking potential.
• 2026-07-25 As of RESEARCH-phase analysis, no CVE identifier had been assigned to GHSA-cj9v-h4hq-29jr and no public PoC or in-the-wild exploitation had been reported.

Sources cited for FreeRDP CLIPRDR heap overflow

• FreeRDP 3.29.0 official release announcement freerdp.com · Vendor report · 2026-07-13
• FreeRDP/FreeRDP GitHub Security Advisory GHSA-cj9v-h4hq-29jr: Windows Client Cliprdr Virtual Channel Heap Buffer Overflow GitHub · Code repository · 2026-07-15
• GitHub Release: FreeRDP 3.29.0 (tag) GitHub · Code repository · 2026-07-13
• GBHackers: Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code gbhackers.com · News · 2026-07-23
• CyberPress: Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code cyberpress.org · News · 2026-07-23
• Help Net Security: FreeRDP 3.29.0 security update resolves 22 advisories Help Net Security · News · 2026-07-15
• Linuxiac: FreeRDP 3.29 Is Out With Extensive Security Fixes linuxiac.com · News · 2026-07-15
• news4hackers: FreeRDP 3.29.0 Security Update Fixes 22 Critical Vulnerabilities news4hackers.com · News · 2026-07-15

Threats related to FreeRDP CLIPRDR heap overflow

• AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627)
• Oracle August 2026 CSPU: Nine Vulnerabilities in Agile Engineering Data Management 6.2.1, Including Unauthenticated Web Services Security Flaws (CVE-2026-71052, CVE-2026-71053)
• Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws
• Multiple Zscaler Client Connector Flaws Enable Remote Code Execution (CVE-2026-59568)
• Redis RCE CVE-2026-23479 — Use-After-Free in unblockClientOnKey() (Authenticated, CVSS 8.8)

Related coverage of this activity

• Akrites open-source CVD platform
• Avada Fusion Builder RCE
• OpenSSL OCSP memory leak DoS
• SCTPhantom Linux kernel privilege escalation
• Citrix NetScaler auth bypass